CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-38346 – Apache CloudStack: Unauthenticated cluster service port leads to remote execution
https://notcve.org/view.php?id=CVE-2024-38346
05 Jul 2024 — The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on Clou... • http://www.openwall.com/lists/oss-security/2024/07/05/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-39864 – Apache CloudStack: Integration API service uses dynamic port when disabled
https://notcve.org/view.php?id=CVE-2024-39864
05 Jul 2024 — The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is considered disabled when integration.api.port is set to 0 or negative. Due to an improper initialisation logic, the integration API service would listen on a random port when its port value is set to 0 (default va... • http://www.openwall.com/lists/oss-security/2024/07/05/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-26779 – Apache Cloudstack insecure random number generation affects project email invitation
https://notcve.org/view.php?id=CVE-2022-26779
15 Mar 2022 — Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID fo... • http://www.openwall.com/lists/oss-security/2022/03/15/1 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17562
https://notcve.org/view.php?id=CVE-2019-17562
14 May 2020 — A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. • https://lists.apache.org/thread.html/rcbaafc6ae1f32e8f1e5987c243a26faf83c5172348ee7c17a54ea7f9%40%3Cusers.cloudstack.apache.org%3E • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2013-4317
https://notcve.org/view.php?id=CVE-2013-4317
06 Feb 2018 — In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own. En Apache CloudStack 4.1.0 y 4.1.1, al llamar a la API CloudStack call listProjectAccounts como usuario normal no administrativo, el usuario puede ver información de cuentas distintas a la propia. • http://seclists.org/oss-sec/2018/q1/1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-6813
https://notcve.org/view.php?id=CVE-2016-6813
06 Feb 2018 — Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources. Apache CloudStack 4.1 a 4.8.1.0 y 4.9.0.0 contiene una llamada API diseñada para permitir a un usuario registrarse en la API del desarrollador. Si un usuario malicioso es capaz d... • http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2015-3252 – Apache CloudStack 4.4.4 / 4.5.1 VNC Authentication Issue
https://notcve.org/view.php?id=CVE-2015-3252
06 Feb 2016 — Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server. Apache CloudStack en versiones anteriores a 4.5.2 no conserva adecuadamente las contraseñas VNC al migrar máquinas virtuales KVM, lo que permite a atacantes remotos obtener acceso mediante la conexión al servidor VNC. Apache CloudStack sets a VNC password unique to each KVM virtual machine under management. Upon migrating a... • http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-9593
https://notcve.org/view.php?id=CVE-2014-9593
15 Jan 2015 — Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call. Apache CloudStack anterior a 4.3.2 y 4.4.x anterior a 4.4.2 permite a atacantes remotos obtener claves privados a través de una llamada a la API listSslCerts. • http://docs.cloudstack.apache.org/projects/cloudstack-release-notes/en/4.3.2/about.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2013-2758
https://notcve.org/view.php?id=CVE-2013-2758
23 May 2014 — Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predictable sequence, which makes it easier for remote attackers to guess the console access URL via a brute force attack. Apache CloudStack 4.0.0 anterior a 4.0.2 y Citrix CloudPlatform (anteriormente Citrix CloudStack) 3.0.x anterior a 3.0.6 Patch C utiliza un hash de una secuencia previsible, lo que facilita a atacantes remotos adivinar la URL de acceso de consola a travé... • http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C51786984.1060300%40stratosec.co%3E • CWE-310: Cryptographic Issues •
CVSS: 9.1EPSS: 0%CPEs: 8EXPL: 0CVE-2013-2756
https://notcve.org/view.php?id=CVE-2013-2756
23 May 2014 — Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code. Apache CloudStack 4.0.0 anterior a 4.0.2 y Citrix CloudPlatform (anteriormente Citrix CloudStack) 3.0.x anterior a 3.0.6 Patch C permite a atacantes remotos evadir la autenticación de proxy de consola mediante el conocimiento del código fuente. • http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C51786984.1060300%40stratosec.co%3E • CWE-287: Improper Authentication •