CVE-2024-13058 Authenticated, non-admin users can create storage pools via the sifi API
Authenticated non-admin users can create storage pools, potentially degrading performance and availability of the storage subsystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-13058?
CVE-2024-13058 is a medium-severity missing authorization vulnerability in SoftIron HyperCloud, published on 30 Dec 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem.
This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
Which versions are affected by CVE-2024-13058?
How do I fix CVE-2024-13058?
No fix has been published for CVE-2024-13058 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-13058 being exploited?
There is no known exploitation of CVE-2024-13058 in the wild and no public exploit code.
Sources
Also known as GHSA-j5p2-95x6-9mr4.