CVE-2012-5616 Information disclosure in n/a

What is CVE-2012-5616?

CVE-2012-5616 is a low-severity vulnerability in Apache Cloudstack, published on 22 Jan 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.

Weakness: CWE-255

Which versions are affected by CVE-2012-5616?

1 open source package ship an affected version, including org.apache.cloudstack:cloudstack. It affects 2 products.

Products include Apache Cloudstack, Citrix Cloudplatform.

How do I fix CVE-2012-5616?

No fix has been published for CVE-2012-5616 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-5616 being exploited?

There is no known exploitation of CVE-2012-5616 in the wild and no public exploit code.

Other vulnerabilities in Apache Cloudstack

• CVE-2012-4501 Missing authorization in n/a Critical 10.0
• CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution Critical 9.8
• CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled Critical 9.8
• CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default Critical 9.8
• CVE-2022-35741 Apache CloudStack SAML Single Sign-On XXE Critical 9.8

All Apache Cloudstack vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3pqh-mpvw-5fr2.