CVEvulnerability

CVE-2014-9386

6.8 MEDIUM Published 2014-12-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-12-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.

Affected configurations

• zenoss zenoss core (<= 4.2.5) • zenoss zenoss core 2.4.0 • zenoss zenoss core 2.4.5 • zenoss zenoss core 2.5.0 • zenoss zenoss core 2.5.1 • zenoss zenoss core 2.5.2 • zenoss zenoss core 3.0.0 • zenoss zenoss core 3.0.1 • zenoss zenoss core 3.0.2 • zenoss zenoss core 3.0.3 • zenoss zenoss core 3.1.0 • zenoss zenoss core 3.2.0 • zenoss zenoss core 3.2.1 • zenoss zenoss core 4.2.0 • zenoss zenoss core 4.2.3 • zenoss zenoss core 4.2.4

References