Vulnerabilities > CVE-2015-3252 - Credentials Management vulnerability in Apache Cloudstack

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

apache

CWE-255

critical

NVD

Published: 2016-02-08

Updated: 2024-11-21

Summary

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Cloudstack 2.0 Apache Cloudstack 2.0.1 Apache Cloudstack 2.1.0 Apache Cloudstack 2.1.1 Apache Cloudstack 2.1.2 Apache Cloudstack 2.1.3 Apache Cloudstack 2.1.4 Apache Cloudstack 2.1.5 Apache Cloudstack 2.1.6 Apache Cloudstack 2.1.7 Apache Cloudstack 2.1.8 Apache Cloudstack 2.1.9 Apache Cloudstack 2.1.10 Apache Cloudstack 2.2.0 Apache Cloudstack 2.2.1 Apache Cloudstack 2.2.2 Apache Cloudstack 2.2.3 Apache Cloudstack 2.2.5 Apache Cloudstack 2.2.6 Apache Cloudstack 2.2.7 Apache Cloudstack 2.2.8 Apache Cloudstack 2.2.9 Apache Cloudstack 2.2.11 Apache Cloudstack 2.2.12 Apache Cloudstack 2.2.13 Apache Cloudstack 2.2.14 Apache Cloudstack 3.0.0 Apache Cloudstack 3.0.1 Apache Cloudstack 3.0.2 Apache Cloudstack 4.0.0 Apache Cloudstack 4.0.1 Apache Cloudstack 4.0.2 Apache Cloudstack 4.1.0 Apache Cloudstack 4.1.1 Apache Cloudstack 4.2.0 Apache Cloudstack 4.2.1 Apache Cloudstack 4.3.0 Apache Cloudstack 4.3.1 Apache Cloudstack 4.3.2 Apache Cloudstack 4.4.0 Apache Cloudstack 4.4.1 Apache Cloudstack 4.4.2 Apache Cloudstack 4.4.3 Apache Cloudstack 4.4.4 Apache Cloudstack 4.5.0 Apache Cloudstack 4.5.1	47

Common Weakness Enumeration (CWE)

CWE-255 - Credentials Management

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References