CVE-2012-4501 Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
HighCVSS 10.0
EPSS 7.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cloudstack | All versions | No fix listed |
| citrix cloudstack | All versions | No fix listed |
References
- 20121010 [CVE-2012-4501] CloudStack configuration vulnerability mailing-list
- cloudstack.org vendor-advisory
- [cloudstack-dev] 20121007 [CVE-2012-4501] CloudStack security announcement mailing-list