ID de Prueba:	1.3.6.1.4.1.25623.1.0.800990
Categoría:	Web application abuses
Título:	Zenoss Server Multiple Vulnerabilities
Resumen:	Zenoss Server is prone to multiple vulnerabilities.
Descripción:	Summary: Zenoss Server is prone to multiple vulnerabilities. Vulnerability Insight: - Input passed via the 'severity', 'state', 'filter', 'offset', and 'count' parameters to /zport/dmd/Events/getJSONEventsInfo is not properly sanitised before being used in SQL queries. - The application allows administrative users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change administrator passwords via zport/dmd/ZenUsers/admin or execute arbitrary shell commands via zport/dmd/userCommands/ by tricking an administrative user into visiting a malicious web site. Vulnerability Impact: Successful exploitation will allow remote attackers to view, add, modify or delete information in the back-end database or conduct cross site request forgery attacks. Affected Software/OS: Zenoss Server versions prior to 2.5. Solution: Update to version 2.5 or later. Please see the references for more info. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2010-0712 BugTraq ID: 37802 http://www.securityfocus.com/bid/37802 http://dev.zenoss.org/trac/changeset/15257 http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-001-zenoss-getjsoneventsinfo-sql-injection/ http://osvdb.org/61804 http://secunia.com/advisories/38195 XForce ISS Database: zenoss-getjsoneventsinfo-sql-injection(55670) https://exchange.xforce.ibmcloud.com/vulnerabilities/55670 Common Vulnerability Exposure (CVE) ID: CVE-2010-0713 BugTraq ID: 37843 http://www.securityfocus.com/bid/37843 Bugtraq: 20100116 Zenoss Multiple Admin CSRF (Google Search) http://www.securityfocus.com/archive/1/508982/100/0/threaded http://www.ngenuity.org/wordpress/2010/01/14/ngenuity-2010-002-zenoss-multiple-admin-csrf/ http://osvdb.org/61805
Copyright	Copyright (C) 2010 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.