Description
Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/537459/100/0/threaded
Vendor Advisory mailing-list
x_refsource_mlist
http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E
Scores
CVSS v3
9.8
EPSS
0.0187
EPSS Percentile
83.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-255
Status
published
Products (1)
apache/cloudstack
< 4.5.1
Published
Feb 08, 2016
Tracked Since
Feb 18, 2026