CVE-2014-9385: Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to...

Security readout for executives and security teams

This CVE describes a CSRF issue in Zenoss Core through 5 Beta 3. If a logged-in user is tricked into making a malicious request, the attacker may cause a ZenPack upload that leads to arbitrary code execution. The source bundle does not identify a fixed version or active exploitation. Exposure is most likely where Zenoss Core through 5 Beta 3 is deployed, especially administrative interfaces reachable by users who browse the web while authenticated. The bundle gives no reliable CPE inventory or downstream product mapping. Prioritize finding and isolating affected legacy Zenoss systems. The business risk is potentially server-side code execution through an authenticated user’s browser session, but the evidence bundle does not prove exploitation in the wild. Mitigation focus: Check Zenoss and CERT guidance for fixed versions or vendor-approved remediation.; Remove or isolate Zenoss Core through 5 Beta 3 from untrusted networks.; Restrict administrative access to trusted networks, VPNs, and approved administrators..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.