PT-2014-8978
CVE-2014-9386
·
Published
2014-12-15
·
Updated
2016-03-21
Description by
CVSS 2.0
6.8
MediumMetricsAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
Zenoss Core versions prior to 4.2.5 SP161
Description
The issue allows remote attackers to hijack sessions by leveraging an unattended workstation, as the session ID cookie has an infinite lifetime.
Recommendations
For versions prior to 4.2.5 SP161, update to version 4.2.5 SP161 or later to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾