CVE-2013-4317

MEDIUM

Apache CloudStack 4.1.0-4.1.1 - Unauthorized Exposure of Sensitive Information via listProjectAccounts API

Title source: llm

Description

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.

References (1)

Core 1

Core References

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://seclists.org/oss-sec/2018/q1/1

Scores

CVSS v3 4.3

EPSS 0.0046

EPSS Percentile 64.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

apache/cloudstack 4.1.0

apache/cloudstack 4.1.1

Published Feb 06, 2018

Tracked Since Feb 18, 2026