CVE-2012-4501

Published: Oct 26, 2012Modified: Apr 29, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.

Affected (2)

Products: Apache: Cloudstack · Citrix: Cloudstack

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Cloudstack	All versions
Citrix Cloudstack	All versions

Related CWEs

CWE-264

References (6)

http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html

Source: secalert@redhat.com

http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html

Source: secalert@redhat.com

Vendor Advisory

http://markmail.org/thread/yfuxgymdqwg3kcg4

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://markmail.org/thread/yfuxgymdqwg3kcg4

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.