CVE-2013-2756

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-23 · updated 2026-06-16
Weakness: CWE-287

Description

Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code.

Affected products

Apache Software Foundation Apache CloudStack: 4.0.0-incubating; 4.0.1, 4.0.2 (and their updates)
Citrix Cloudplatform: 3.0, 3.0.3, 3.0.4, 3.0.5, 3.0.6 (and their updates)

References

http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C51786984.1060300%40stratosec.co%3E
http://osvdb.org/92748
http://secunia.com/advisories/53175
http://secunia.com/advisories/53204
http://support.citrix.com/article/CTX135815
http://www.securityfocus.com/bid/59463
http://www.securitytracker.com/id/1028473
https://exchange.xforce.ibmcloud.com/vulnerabilities/83781
http://mail-archives.apache.org/mod_mbox/cloudstack-dev/201304.mbox/%3C51786984.1060300%40stratosec.co%3E
http://osvdb.org/92748
http://secunia.com/advisories/53175
http://secunia.com/advisories/53204

Get alerted when CVE-2013-2756 or the next vulnerability affects your stack