Zenoss Core logon form opening Redirection Vulnerability

Zenoss Core logon form opening Redirection Vulnerability

Release date:
Updated on:

Affected Systems:
Zenoss Core <4.2.5 SP161
Description:
CVE (CAN) ID: CVE-2014-6255

Zenoss Core is an open-source IT monitoring solution.

The logon form of earlier versions of Zenoss Core 4.2.5 SP161 has multiple open redirection security vulnerabilities. Remote attackers use the came_from parameter to perform phishing attacks.

<* Source: Ryan Koppenhaver

Link: http://www.kb.cert.org/vuls/id/449452
*>

Suggestion:
Vendor patch:

Zenoss
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit? Usp = sharing

This article permanently updates the link address: