critical10.0
CVE-2012-4501
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as d…
Impact
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Cloudstack | All versions |
| Citrix | Cloudstack | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html
- http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html
- http://markmail.org/thread/yfuxgymdqwg3kcg4
- http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html
- http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html
- http://markmail.org/thread/yfuxgymdqwg3kcg4