CVE-2015-3252

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.

Score

CVSS 3.0 9.8 Critical

Status

Modified - secalert@redhat.com

Published

2016-02-08

Last modified

2024-08-06

Weaknesses

CWE-255

Affected products

• Cloudstack (Apache)

References

• http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.c…
• http://www.securityfocus.com/archive/1/537459/100/0/threaded
• https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories