CVE-2014-6256
HighSummary
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public read or execute access via a move action.
Risk Assessment
Attackers can exploit this vulnerability to place malicious files in a publicly accessible directory, potentially leading to further attacks on the system.
Recommendation
It is recommended to update Zenoss Core to the latest version to mitigate this vulnerability and review directory access settings.
Other vulnerabilities in Zenoss Core
See all- CVE-2014-9249High
The default configuration of Zenoss Core before version 5 allows remote attackers to read or modify database information by connecting to unspecified open ports.
- CVE-2014-6261High
Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, allowing remote attackers to execute arbitrary code by spoofing the callhome server or deploying a crafted web site visited during a login session.
Original NVD description (English source)
Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1) read or (2) execute access via a move action, aka ZEN-15386.