CVE-2012-4501

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.

Score

CVSS 2.0 10.0 Critical

Status

Modified - secalert@redhat.com

Published

2012-10-26

Last modified

2024-09-17

Weaknesses

CWE-264

Affected products

• Cloudstack (Apache)
• Cloudstack (Citrix)

References

• http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html
• http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html
• http://markmail.org/thread/yfuxgymdqwg3kcg4