CVE-2013-6398

Apache CloudStack < 4.2.1 - Firewall Rule Bypass via Virtual Router Restart

Title source: llm
STIX 2.1

Description

The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall rules after being restarted, which allows remote attackers to bypass intended restrictions via a request.

References (7)

Core 7
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60284
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/55960
Various Sources x_refsource_confirm
https://issues.apache.org/jira/browse/CLOUDSTACK-5263
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/69432
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1030762
Vendor Advisory x_refsource_confirm
http://support.citrix.com/article/CTX140989

Scores

EPSS 0.0099
EPSS Percentile 77.1%

Details

CWE
CWE-264
Status published
Products (35)
apache/cloudstack 2.0
apache/cloudstack 2.0.1
apache/cloudstack 2.1.0
apache/cloudstack 2.1.1
apache/cloudstack 2.1.2
apache/cloudstack 2.1.3
apache/cloudstack 2.1.4
apache/cloudstack 2.1.5
apache/cloudstack 2.1.6
apache/cloudstack 2.1.7
... and 25 more
Published Jan 15, 2014
Tracked Since Feb 18, 2026