CVEvulnerability
CVE-2010-0712
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-02-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.
Affected configurations
• zenoss zenoss (<= 2.4.5)
• zenoss zenoss 2.3.0
• zenoss zenoss 2.3.3
• zenoss zenoss 2.4.0
• zenoss zenoss 2.4.2
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://dev.zenoss.org/trac/changeset/15257 Vendor Advisory
- http://osvdb.org/61804 osvdb.org
- http://secunia.com/advisories/38195 Vendor Advisory
- http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/ www.ngenuity.org
- http://www.securityfocus.com/bid/37802 Exploit
- http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55670 exchange.xforce.ibmcloud.com
- http://dev.zenoss.org/trac/changeset/15257 Vendor Advisory
- http://osvdb.org/61804 osvdb.org
- http://secunia.com/advisories/38195 Vendor Advisory
- http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/ www.ngenuity.org
- http://www.securityfocus.com/bid/37802 Exploit
- http://www.zenoss.com/news/SQL-Injection-and-Cross-Site-Forgery-in-Zenoss-Core-Corrected.html Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55670 exchange.xforce.ibmcloud.com