Lucene search

ApacheCVE-2016-6813

HistoryFeb 06, 2018 - 2:29 p.m.

CVE-2016-6813

2018-02-0614:29:00

apache

web.nvd.nist.gov

cve-2016-6813

apache cloudstack

api

security vulnerability

nvd

access control

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

56.0%

JSON

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-“root”) CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.

Affected configurations

Nvd

Vulners

Node

apachecloudstackRange4.1.0–4.8.1.0

apachecloudstackMatch4.9.0

VendorProductVersionCPE
apachecloudstack*cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*
apachecloudstack4.9.0cpe:2.3:a:apache:cloudstack:4.9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	cloudstack	*	cpe:2.3:a:apache:cloudstack::::::::
apache	cloudstack	4.9.0	cpe:2.3:a:apache:cloudstack:4.9.0:::::::*

CNA Affected

[
  {
    "product": "Apache CloudStack",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "4.1 to 4.8.1.0"
      },
      {
        "status": "affected",
        "version": "4.9.0.0"
      }
    ]
  }
]

References

mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E

www.securityfocus.com/bid/93945

s.apache.org/qV5l

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

56.0%

JSON

Related for CVE-2016-6813