Critical severity9.8NVD Advisory· Published Feb 6, 2018· Updated Jun 17, 2026
CVE-2016-6813
CVE-2016-6813
Description
Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.
Affected products
4cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*range: >=4.1.0,<=4.8.1.0
- cpe:2.3:a:apache:cloudstack:4.9.0:*:*:*:*:*:*:*
- (no CPE)range: 4.1 - 4.8.1.0, 4.9.0.0
- (no CPE)range: 4.1 to 4.8.1.0
Patches
Vulnerability mechanics
References
3- www.securityfocus.com/bid/93945nvdBroken LinkThird Party AdvisoryVDB Entry
- s.apache.org/qV5lnvdVendor Advisory
- mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3Envd
News mentions
0No linked articles in our index yet.