CRITICAL🇵🇱 Wersja polska

CVE-2019-17562

CVSS 9.8v3.1pub. 2020-05-14upd. 2024-11-21

A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Apache Cloudstack

    APP
    Apache
    < 4.13.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Memory
CWE
References

Related vulnerabilities

CVE-2026-25199CRITICAL9.1PL ✓ten sam produkt

Apache CloudStack: nieautoryzowany dostęp między tenantami przez rozszerzenie Proxmox

CVE-2024-39864CRITICAL9.8PL ✓ten sam produkt

Apache CloudStack — RCE przez niechroniony port integracyjny API

CVE-2024-38346CRITICAL9.8PL ✓ten sam produkt

Apache CloudStack — RCE przez nieuwierzytelniony port klastra (9090)

CVE-2024-29006CRITICAL9.8PL ✓ten sam produkt

Apache CloudStack: authentication bypass przez manipulację nagłówkiem x-forwarded-for

CVE-2022-35741CRITICAL9.8ten sam produkt

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found...