CVE-2014-0031: Medium severity Apache CloudStack vulnerability
Published Jan 14, 2014
·Updated
The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request.
Affected Software
35 affected components
Apache CloudStack<=4.2.0
Apache CloudStack=2.0
Apache CloudStack=2.0.1
Apache CloudStack=2.1.0
Apache CloudStack=2.1.1
Apache CloudStack=2.1.2
Apache CloudStack=2.1.3
Apache CloudStack=2.1.4
Apache CloudStack=2.1.5
Apache CloudStack=2.1.6
Apache CloudStack=2.1.7
Apache CloudStack=2.1.8
Apache CloudStack=2.1.9
Apache CloudStack=2.1.10
Apache CloudStack=2.2.0
Apache CloudStack=2.2.1
Apache CloudStack=2.2.2
Apache CloudStack=2.2.3
Apache CloudStack=2.2.5
Apache CloudStack=2.2.6
Apache CloudStack=2.2.7
Apache CloudStack=2.2.8
Apache CloudStack=2.2.9
Apache CloudStack=2.2.11
Apache CloudStack=2.2.12
Apache CloudStack=2.2.13
Apache CloudStack=2.2.14
Apache CloudStack=3.0.0
Apache CloudStack=3.0.1
Apache CloudStack=3.0.2
Apache CloudStack=4.0.0-incubating
Apache CloudStack=4.0.1
Apache CloudStack=4.0.2
Apache CloudStack=4.1.0
Apache CloudStack=4.1.1
Event History
Jan 14, 2014
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Jan 15, 2014
Data Sourced
via NVD·04:08 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0031?
The severity of CVE-2014-0031 is classified as medium.
2
Who is impacted by CVE-2014-0031?
CVE-2014-0031 affects remote authenticated users in Apache CloudStack versions prior to 4.2.1.
3
How do I fix CVE-2014-0031?
To fix CVE-2014-0031, it is recommended to upgrade Apache CloudStack to version 4.2.1 or later.
4
What are the potential consequences of CVE-2014-0031?
CVE-2014-0031 could allow an authenticated user to list network ACLs of other users, leading to unauthorized information disclosure.
5
What specific APIs are vulnerable in CVE-2014-0031?
CVE-2014-0031 impacts the ListNetworkACL and listNetworkACLLists APIs in Apache CloudStack.