CVE-2013-6480

Published: Jan 7, 2014Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Affected (5)

Products: Apache: Libcloud

Apache

1 product

Libcloud

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Apache Libcloud	Version 0.12.3
Apache Libcloud	Version 0.12.4
Apache Libcloud	Version 0.13.0
Apache Libcloud	Version 0.13.1
Apache Libcloud	Version 0.13.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

http://libcloud.apache.org/security.html

Source: secalert@redhat.com

Vendor Advisory

http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/530624/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/64617

Source: secalert@redhat.com

https://digitalocean.com/blog_posts/transparency-regarding-data-security

Source: secalert@redhat.com

https://github.com/fog/fog/issues/2525

Source: secalert@redhat.com

http://libcloud.apache.org/security.html