CVE-2012-5616

Severity: low (CVSS 1.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-01-22 · updated 2026-06-16
Weakness: CWE-255

Description

Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.

Affected products

Apache Software Foundation Apache CloudStack: 4.0.0-incubating
Citrix Cloudplatform: through 3.0.5

References

http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E
http://osvdb.org/89070
http://osvdb.org/89146
http://osvdb.org/89147
http://seclists.org/fulldisclosure/2013/Jan/65
http://secunia.com/advisories/51366
http://secunia.com/advisories/51821
http://secunia.com/advisories/51827
http://support.citrix.com/article/CTX136163
http://www.securityfocus.com/bid/57225
http://www.securityfocus.com/bid/57259
http://www.securitytracker.com/id?1027978

Get alerted when CVE-2012-5616 or the next vulnerability affects your stack