CVE-2015-3252

Published: Feb 8, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.

Affected (1)

Products: Apache: Cloudstack

Apache

1 product

Cloudstack

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Cloudstack	Up to 4.5.1

Related CWEs

CWE-255

References (6)

http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/archive/1/537459/100/0/threaded

Source: secalert@redhat.com

https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories

Source: secalert@redhat.com

Vendor Advisory

http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/archive/1/537459/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.