« Volver al listado

CVE-2012-4501

Estado: ModificadaAlta (10)—

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Apache — CloudstackCitrix — Cloudstack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-4501",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-10-26T10:39:16.047",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://markmail.org/thread/yfuxgymdqwg3kcg4",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://markmail.org/thread/yfuxgymdqwg3kcg4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs."
    },
    {
      "lang": "es",
      "value": "Citrix Cloud.com CloudStack, y Apache CloudStack pre-release, permite a atacantes remotos a realizar llamadas a la API aprovechando la cuenta system, como se demostró mediante llamadas a la API para eliminar VMs."
    }
  ],
  "lastModified": "2026-06-16T23:45:12.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:-:prerelease:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0BFB5A1-6A88-4B82-B63C-CB8EE8C8576A"
            },
            {
              "criteria": "cpe:2.3:a:citrix:cloudstack:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C7DDB14-BAAF-4194-9FD8-A4767F792268"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}