CVE-2016-6813 Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") Clo...
CriticalCVSS 9.8
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache cloudstack | >= 4.1.0, <= 4.8.1.0 | No fix listed |
| apache cloudstack | = 4.9.0 | No fix listed |
| Apache CloudStack | = 4.1 to 4.8.1.0 | No fix listed |
| Apache CloudStack | = 4.9.0.0 | No fix listed |
References
- [www-announce] 20161028 [SECURITY] CVE-2016-6813: Apache CloudStack registerUserKeys authorization vulnerability mailing-list
- 93945 broken-link third-party-advisory vdb-entry
- [cloudstack-announce] 20161027 Apache CloudStack Security Releases 4.8.1.1, 4.9.0.1 mailing-list vendor-advisory