CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-38346 – Apache CloudStack: Unauthenticated cluster service port leads to remote execution
https://notcve.org/view.php?id=CVE-2024-38346
05 Jul 2024 — The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code execution via agents on the hosts that may run as a privileged user. An attacker that can reach the cluster service on the unauthenticated port (default 9090), can exploit this to perform remote code execution on Clou... • http://www.openwall.com/lists/oss-security/2024/07/05/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-39864 – Apache CloudStack: Integration API service uses dynamic port when disabled
https://notcve.org/view.php?id=CVE-2024-39864
05 Jul 2024 — The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is considered disabled when integration.api.port is set to 0 or negative. Due to an improper initialisation logic, the integration API service would listen on a random port when its port value is set to 0 (default va... • http://www.openwall.com/lists/oss-security/2024/07/05/1 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-665: Improper Initialization •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-35741 – Apache CloudStack SAML Single Sign-On XXE
https://notcve.org/view.php?id=CVE-2022-35741
18 Jul 2022 — Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache... • http://www.openwall.com/lists/oss-security/2022/07/18/2 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-26779 – Apache Cloudstack insecure random number generation affects project email invitation
https://notcve.org/view.php?id=CVE-2022-26779
15 Mar 2022 — Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID fo... • http://www.openwall.com/lists/oss-security/2022/03/15/1 • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17562
https://notcve.org/view.php?id=CVE-2019-17562
14 May 2020 — A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. • https://lists.apache.org/thread.html/rcbaafc6ae1f32e8f1e5987c243a26faf83c5172348ee7c17a54ea7f9%40%3Cusers.cloudstack.apache.org%3E • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-6813
https://notcve.org/view.php?id=CVE-2016-6813
06 Feb 2018 — Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources. Apache CloudStack 4.1 a 4.8.1.0 y 4.9.0.0 contiene una llamada API diseñada para permitir a un usuario registrarse en la API del desarrollador. Si un usuario malicioso es capaz d... • http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2016-3085 – Apache CloudStack 4.5.0 Authentication Bypass
https://notcve.org/view.php?id=CVE-2016-3085
09 Jun 2016 — Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin. Apache CloudStack 4.5.x en versiones anteriores a 4.5.2.1, 4.6.x en versiones anteriores a 4.6.2.1, 4.7.x en versiones anteriores a 4.7.1.1 y 4.8.x en versiones anteriores a 4.8.0.1, cuando la autenticación SAML-based está activa y ... • http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html • CWE-254: 7PK - Security Features CWE-287: Improper Authentication •