Unscored CVE-2012-4501 EUVD-2012-4430GHSA-g376-qg9c-3v47

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the syste…

Published Oct 26, 2012 · Updated Sep 17, 2024 · Assigned by redhat

Description

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.

References

[cloudstack-dev] 20121007 [CVE-2012-4501] CloudStack security announcement mailing-list
20121010 [CVE-2012-4501] CloudStack configuration vulnerability mailing-list
http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html