PT-2018-4100 · Apache · Apache Cloudstack

Ahmad Emneina · Publicado 2018-02-06 · Atualizado 2018-02-26 · CVE-2013-4317

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.1.0 through 4.1.1

Description The issue allows a regular, non-administrative user to see information for accounts other than their own when calling the "listProjectAccounts" API endpoint.

Recommendations For Apache CloudStack versions 4.1.0 and 4.1.1, consider restricting access to the "listProjectAccounts" API endpoint until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-4317

Produtos afetados

Apache Cloudstack

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-4317 · Nota de Segurança
• http://seclists.org/oss-sec/2018/q1/1 · Nota