« Back to list

CVE-2012-4501

Status: ModifiedHigh (10)—

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Apache — CloudstackCitrix — Cloudstack

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2012-4501",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-10-26T10:39:16.047",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://markmail.org/thread/yfuxgymdqwg3kcg4",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-10/0062.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://cloudstack.org/blog/185-cloudstack-configuration-vulnerability-discovered.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://markmail.org/thread/yfuxgymdqwg3kcg4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs."
    },
    {
      "lang": "es",
      "value": "Citrix Cloud.com CloudStack, y Apache CloudStack pre-release, permite a atacantes remotos a realizar llamadas a la API aprovechando la cuenta system, como se demostró mediante llamadas a la API para eliminar VMs."
    }
  ],
  "lastModified": "2026-06-16T23:45:12.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:-:prerelease:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0BFB5A1-6A88-4B82-B63C-CB8EE8C8576A"
            },
            {
              "criteria": "cpe:2.3:a:citrix:cloudstack:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C7DDB14-BAAF-4194-9FD8-A4767F792268"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}