PT-2010-5159 · Eucalyptus · Eucalyptus

Publicado 2010-12-22 · Atualizado 2017-08-17 · CVE-2010-3905

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eucalyptus versions 2.0.0 through 2.0.1

Description The issue concerns the password reset feature in the administrator interface, which fails to perform authentication. This allows remote attackers to send password reset requests for other users, potentially gaining privileges.

Recommendations For Eucalyptus versions 2.0.0 and 2.0.1, consider disabling the password reset feature in the administrator interface until a fix is available to prevent unauthorized access.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-3905

Produtos afetados

Eucalyptus

Referências · 9

• http://vupen.com/english/advisories/2010/3259 · Aviso do Fabricante
• http://open.eucalyptus.com/wiki/esa-01 · Nota
• http://vupen.com/english/advisories/2010/3260 · Aviso do Fabricante
• http://securityfocus.com/bid/45462 · Nota
• http://secunia.com/advisories/42632 · Aviso do Fabricante
• http://secunia.com/advisories/42666 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64167 · Nota
• http://ubuntu.com/usn/USN-1033-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3905 · Nota de Segurança