Security Advisory
CVE-2012-10048
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user.