CVE-2014-9247: Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-...

Security readout for executives and security teams

CVE-2014-9247 is an authenticated information disclosure issue in Zenoss Core through 5 Beta 3. A logged-in remote user may view user account, email address, and role information through the ZenUsers/User Manager page. This exposes identity and authorization data that can support follow-on social engineering or privilege targeting. Organizations are exposed if they still run Zenoss Core through 5 Beta 3 and allow non-administrative authenticated users to reach ZenUsers/User Manager. Internet exposure increases concern, but the cited sources do not describe unauthenticated access. Treat this as a moderate governance and privacy risk for legacy Zenoss environments. It should be prioritized where Zenoss contains sensitive operational users or is reachable by broad internal user groups, but the source bundle does not support emergency exploitation claims. Mitigation focus: Identify any Zenoss Core deployments and versions in use.; Check vendor or CERT guidance for fixed versions or official mitigations.; Restrict ZenUsers/User Manager access to authorized administrators only..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.