← Back

CVE-2016-3085

nvd nist
Published: Jun 10, 2016Modified: May 6, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Exploitability: 2.2 / Impact: 4.2
Source: NVD

Description

Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin.

Affected (7)

Products: Apache: Cloudstack
Apache
1 product
Cloudstack
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Cloudstack
Version 4.7.0
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Cloudstack
Version 4.5.1
Cloudstack
Version 4.5.2
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Cloudstack
Version 4.6.0
Cloudstack
Version 4.6.1
Cloudstack
Version 4.6.2
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Cloudstack
Version 4.8

Related CWEs

CWE-254
CWE-254
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

Source: secalert@redhat.com
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.