PT-2014-2629 · Apache+1 · Apache Cloudstack+1

Published 2014-05-23 · Updated 2017-08-29 · CVE-2013-2756

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.0.0 through 4.0.2 Citrix CloudPlatform versions 3.0.x through 3.0.6 Patch C

Description The issue allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code.

Recommendations For Apache CloudStack versions 4.0.0 through 4.0.2, update to version 4.0.2 or later. For Citrix CloudPlatform versions 3.0.x through 3.0.6 Patch C, apply Patch C or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-2756

Affected Products

Apache Cloudstack

Citrix Cloudplatform

References · 9

• http://support.citrix.com/article/CTX135815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2756 · Security Note
• http://osvdb.org/92748 · Note
• http://secunia.com/advisories/53175 · Note
• http://securitytracker.com/id/1028473 · Note
• http://securityfocus.com/bid/59463 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83781 · Note
• http://secunia.com/advisories/53204 · Note
• http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C51786984.1060300%40stratosec.co%3E · Note