CVE:CVE-2010-0712
CNNVD:CNNVD-201002-286
Zenoss的zport/dmd/Events/getJSONEventsInfo中存在多个SQL注入漏洞。远程认证用户可以借助参数(1) severity, (2) state, (3) filter, (4) offset, 和 (5) count 执行任意的SQL命令。
solution:Upgrade zenoss zenoss to a higher version than 2.4.5,2.3.0,2.3.3,2.4.0,2.4.2,and avoid the version (,2.4.5],2.3.0,2.3.3,2.4.0,2.4.2