Описание
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Fuse 6 | cloudstack | Not affected |
Показывать по
10
Дополнительная информация
Статус:
Low
Дефект:
CWE-200
https://bugzilla.redhat.com/show_bug.cgi?id=1547241cloudstack: Information disclosure in listProjectAccounts in the CloudStack API
EPSS
Процентиль: 64%
0.01173
Низкий
3.5 Low
CVSS3
Связанные уязвимости
CVSS3: 4.3
nvd
больше 8 лет назад
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.
CVSS3: 4.3
github
около 4 лет назад
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.
EPSS
Процентиль: 64%
0.01173
Низкий
3.5 Low
CVSS3