Zenoss Core CVE-2014-9252 Plain Text Password Information Disclosure Vulnerability

Bugtraq ID:	71541
Class:	Design Error
CVE:	CVE-2014-9252
Remote:	Yes
Local:	No
Published:	Dec 05 2014 12:00AM
Updated:	Dec 05 2014 12:00AM
Credit:	Ryan Koppenhaver and Andy Schmitz of Matasano Security
Vulnerable:	Zenoss Zenoss Core 4.2.4
Not Vulnerable:

Zenoss Core CVE-2014-9252 Plain Text Password Information Disclosure Vulnerability

Zenoss Core is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information such as user credentials that may aid in launching further attacks.

Zenoss Core 4.2.4 is vulnerable; other versions may also be affected.

Zenoss Core CVE-2014-9252 Plain Text Password Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Zenoss Core CVE-2014-9252 Plain Text Password Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Zenoss Core CVE-2014-9252 Plain Text Password Information Disclosure Vulnerability

References:

• Zenoss Home Page (Zenoss)
  
• Vulnerability Note VU#449452: Zenoss Core contains multiple vulnerabilities (CERT)