Vulnerability Description
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cloudstack | >= 4.1.0, <= 4.8.1.0 |
References
- http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOY
- http://www.securityfocus.com/bid/93945Broken LinkThird Party AdvisoryVDB Entry
- https://s.apache.org/qV5lVendor Advisory
- http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOY
- http://www.securityfocus.com/bid/93945Broken LinkThird Party AdvisoryVDB Entry
- https://s.apache.org/qV5lVendor Advisory
FAQ
What is CVE-2016-6813?
CVE-2016-6813 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") Clo...
How severe is CVE-2016-6813?
CVE-2016-6813 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-6813?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cloudstack.