CVE-2023-46326

2023-11-3000:00:00

mitre

www.cve.org

zstack cloud

unauthenticated access

active job

privilege escalation

9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

JSON

ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.

References

github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q