CVE-2014-6255
Estado: ModificadaMedia (6.4)—
Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the came_from parameter, aka ZEN-11998.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
- Puntuación base: 6.4
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.07%
- Percentil entre todas las CVEs puntuadas: 81
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-6255",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-12-15T18:59:08.660",
"references": [
{
"url": "http://www.kb.cert.org/vuls/id/449452",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.kb.cert.org/vuls/id/449452",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the came_from parameter, aka ZEN-11998."
},
{
"lang": "es",
"value": "Vulnerabilidad de redirección abierta en el formulario de inicio de sesión en Zenoss Core anterior a 4.2.5 SP161 permite a atacantes remotos redirigir usuarios a sitios web arbitrarios y realizar ataques de phishing a través del parámetro came_from, también conocido como ZEN-11998."
}
],
"lastModified": "2026-06-17T00:12:46.697",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BEDDF5E-604E-4E5A-9F16-289CC9F042D6",
"versionEndIncluding": "4.2.5"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:2.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81B69C06-16CA-4A73-8EF8-3E2103D14438"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:2.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33BCBA94-31A9-4B0B-943D-8BB31B552B55"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:2.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4CD24A2C-C0B5-43B3-8F8E-7E72FF8B65B5"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F73AE1C8-8EF9-4AD2-88A9-5108B0B64D8A"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:2.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4C24942-BE6F-4BDF-8642-4458229F8995"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BCCAE80F-40D6-44B4-8253-5A27B2A2E015"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "020D8B51-8378-4E4B-A72F-6B5C7ED9CEDD"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84FFAAE5-E7EC-40D7-8BEC-335FB6A9EA56"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE2CE264-118C-4EE1-9454-7940B6EE7704"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "498262F4-FDA2-4FAD-A45A-1C0EE87F83FB"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CAD8E20-EB1E-49E7-9620-539749F125C3"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:3.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B696A404-81CD-4F97-9C45-4E0667685BCB"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:4.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6F74787-A72A-4C79-8682-91DD6BE85E78"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:4.2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7803AA36-92DC-4362-AB99-99A06B1329EC"
},
{
"criteria": "cpe:2.3:a:zenoss:zenoss_core:4.2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60BDF496-3032-48E2-AAE4-849488F308A8"
}
],
"operator": "OR"
}
]
}
],
"vendorComments": [
{
"comment": "Addressed in versions 5.0, 4.2.5.SP167, and 4.2.4.SP555",
"lastModified": "2016-03-21T11:43:37.927",
"organization": "Zenoss"
}
],
"evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/601.html\">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a>",
"sourceIdentifier": "cve@mitre.org"
}