cloudstack-announce mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David Nalley <ke4...@apache.org>
Subject Updated [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users
Date Fri, 10 Jan 2014 14:01:38 GMT
Issued: January 9, 2014
Updated: January 10, 2014

[CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users


Product: Apache CloudStack
Vendor: Apache Software Foundation
Vulnerability type: Information Disclosure
Vulnerable Versions: Apache CloudStack 4.2.0
CVE References: CVE-2014-0031
Risk Level: Low
CVSSv2 Base Scores: 3.5  (AV:N/AC:M/Au:S/C:P/I:N/A:N)

Description:
The Apache CloudStack Security Team was notified of a an
issue in Apache CloudStack which permits an authenticated user to list
network ACLs for other users.

Mitigation:
Upgrading to CloudStack 4.2.1 or higher will mitigate this issue.

References:
https://issues.apache.org/jira/browse/CLOUDSTACK-5145

Credit:
This issue was identified by Marcus Sorensen

Mime
View raw message