PT-2014-8287 · Apache · Apache Cloudstack

Publicado 2014-12-10 · Atualizado 2018-10-09 · CVE-2014-7807

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.3.x through 4.3.1 Apache CloudStack versions 4.4.x through 4.4.1

Description The issue allows remote attackers to bypass authentication via a login request without a password, triggering an unauthenticated bind.

Recommendations For Apache CloudStack versions 4.3.x through 4.3.1, update to version 4.3.2 or later. For Apache CloudStack versions 4.4.x through 4.4.1, update to version 4.4.2 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-7807

Produtos afetados

Apache Cloudstack

Referências · 3

• http://securityfocus.com/archive/1/534176/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7807 · Nota de Segurança
• http://support.citrix.com/article/CTX200285 · Nota