CVE-2024-13058: Authenticated, non-admin users can create storage pools via the sifi API
An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem.
This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13058?
CVE-2024-13058 is considered a moderate severity vulnerability affecting SoftIron HyperCloud.
What issue does CVE-2024-13058 introduce in SoftIron HyperCloud?
CVE-2024-13058 allows authenticated non-admin users to create data pools, potentially impacting performance and availability.
Which versions of SoftIron HyperCloud are affected by CVE-2024-13058?
CVE-2024-13058 affects SoftIron HyperCloud versions between 2.3.0 and 2.5.0.
How do I fix CVE-2024-13058?
To mitigate CVE-2024-13058, restrict the ability to create data pools to admin users only.
Is there a patch available for CVE-2024-13058?
A patch for CVE-2024-13058 may be available from SoftIron, so it's important to check their official advisories.