CVE-2013-4317

Published: Feb 6, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.

Affected (2)

Products: Apache: Cloudstack

Apache

1 product

Cloudstack

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Cloudstack	Version 4.1.0
Apache Cloudstack	Version 4.1.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://seclists.org/oss-sec/2018/q1/1

Source: security@apache.org

Mailing ListThird Party Advisory

http://seclists.org/oss-sec/2018/q1/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.