VULNERABILITY INTELLIGENCE

CVE-2014-9386

CVSS score6.8 MEDIUM

EPSS probability2.05%

CISA KEVNot currently listed

Published2014-12-15

Last modified2026-06-17

CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691.

Primary references

cret@cert.org — Third Party Advisory, US Government Resource
cret@cert.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory