CVE-2016-6813: Critical severity apache cloudstack vulnerability
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6813?
CVE-2016-6813 is classified as a medium severity vulnerability due to its potential impact on user API key security.
How do I fix CVE-2016-6813?
To fix CVE-2016-6813, it is recommended to upgrade Apache CloudStack to version 4.9.1 or later.
What systems are affected by CVE-2016-6813?
CVE-2016-6813 affects Apache CloudStack versions 4.1 to 4.8.1.0 and 4.9.0.0.
What kind of attack is possible with CVE-2016-6813?
CVE-2016-6813 allows a malicious user to potentially reset API keys for non-root CloudStack users.
Is CVE-2016-6813 a known vulnerability?
Yes, CVE-2016-6813 has been publicly disclosed and is well-documented in security advisories.