CVE-2010-3905
First published: Wed Dec 22 2010(Updated: )
The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users.
Credit: security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eucalyptus | =2.0.0 | |
| Eucalyptus | =2.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/45462
- http://secunia.com/advisories/42666
- http://open.eucalyptus.com/wiki/esa-01
- http://www.vupen.com/english/advisories/2010/3260
- http://www.ubuntu.com/usn/USN-1033-1
- http://www.vupen.com/english/advisories/2010/3259
- http://secunia.com/advisories/42632
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64167
Frequently Asked Questions
What is the severity of CVE-2010-3905?
CVE-2010-3905 has a medium severity rating due to its potential for privilege escalation.
How do I fix CVE-2010-3905?
To fix CVE-2010-3905, upgrade to Eucalyptus versions 2.0.2 or later which address this vulnerability.
Who is affected by CVE-2010-3905?
CVE-2010-3905 affects all installations of Eucalyptus versions 2.0.0 and 2.0.1.
What method do attackers use in CVE-2010-3905?
Attackers exploit CVE-2010-3905 by sending unauthorized password reset requests to gain access to other users' accounts.
What are the consequences of CVE-2010-3905?
The consequences of CVE-2010-3905 include unauthorized access to user accounts and potential administrative control over the Eucalyptus environment.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/eucalyptus
- canonical/eucalyptus
- version/eucalyptus/2.0.0
- version/eucalyptus/2.0.1