Apache CloudStack ListNetworkACL API discloses ACLs for other users

2014.01.11
Credit: Marcus Sorensen
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2014-0031
CWE: CWE-264


CVSS Base Score: 4/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Issued: January 9, 2014 Updated: January 10, 2014 [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users Product: Apache CloudStack Vendor: Apache Software Foundation Vulnerability type: Information Disclosure Vulnerable Versions: Apache CloudStack 4.2.0 CVE References: CVE-2014-0031 Risk Level: Low CVSSv2 Base Scores: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) Description: The Apache CloudStack Security Team was notified of a an issue in Apache CloudStack which permits an authenticated user to list network ACLs for other users. Mitigation: Upgrading to CloudStack 4.2.1 or higher will mitigate this issue. References: https://issues.apache.org/jira/browse/CLOUDSTACK-5145 Credit: This issue was identified by Marcus Sorensen

References:

https://issues.apache.org/jira/browse/CLOUDSTACK-5145


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top