CVE-2016-6813 Missing authorization in Apache CloudStack
An attacker can reset API keys for other users by guessing their IDs, leading to unauthorized account access and resource exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6813?
CVE-2016-6813 is a critical missing authorization vulnerability in Apache Cloudstack, published on 6 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.
Which versions are affected by CVE-2016-6813?
It affects 1 product.
Products include Apache Cloudstack.
How do I fix CVE-2016-6813?
No fix has been published for CVE-2016-6813 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-6813 being exploited?
There is no known exploitation of CVE-2016-6813 in the wild and no public exploit code.
Other vulnerabilities in Apache Cloudstack
- CVE-2012-4501 Missing authorization in n/a
- CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- CVE-2024-39864 Apache CloudStack: Integration API service uses dynamic port when disabled
- CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default
- CVE-2022-35741 Apache CloudStack SAML Single Sign-On XXE
Sources
Also known as GHSA-hrqr-xjpc-vfrf.