Description
Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/537458/100/0/threaded
Vendor Advisory mailing-list
x_refsource_mlist
http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C94DD4CB4-F718-4F79-A934-3D677E497114%40gmail.com%3E
Scores
CVSS v3
4.9
EPSS
0.0018
EPSS Percentile
39.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (2)
apache/cloudstack
4.4.4
apache/cloudstack
4.5.1
Published
Feb 08, 2016
Tracked Since
Feb 18, 2026