CVE-2013-4317

CWE-200 — Information Exposure5 documents5 sources
Severity
4.3MEDIUM
EPSS
0.5%
top 35.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache CloudstackApache Cloudstack
Timeline
PublishedFeb 6
Latest updateMay 14

Description

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/cloudstack4.1.0, 4.1.1+1

🔴Vulnerability Details

2
GHSA
GHSA-f3jm-43j9-hpcv: In Apache CloudStack 4↗2022-05-14
▶
CVEList
CVE-2013-4317: In Apache CloudStack 4↗2018-02-06
▶

📋Vendor Advisories

1
Red Hat
cloudstack: Information disclosure in listProjectAccounts in the CloudStack API↗2018-01-03
▶

💬Community

1
Bugzilla
CVE-2013-4317 cloudstack: Information disclosure in listProjectAccounts in the CloudStack API↗2018-02-20
▶
CVE-2013-4317 (MEDIUM CVSS 4.3) | In Apache CloudStack 4.1.0 and 4.1. | cvebase.io