CVE-2013-6398

Severity: low (CVSS 2.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-15 · updated 2026-06-17
Weakness: CWE-264

Description

The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall rules after being restarted, which allows remote attackers to bypass intended restrictions via a request.

Affected products

Apache Software Foundation Apache CloudStack: through 4.2.0; 2.0, 2.0.1, 2.1.0, 2.1.1, 2.1.2, 2.1.3 (+28)

References

http://secunia.com/advisories/55960
http://secunia.com/advisories/60284
http://support.citrix.com/article/CTX140989
http://www.securityfocus.com/bid/69432
http://www.securitytracker.com/id/1030762
https://blogs.apache.org/cloudstack/entry/cve_2013_6398_cloudstack_virtual
https://issues.apache.org/jira/browse/CLOUDSTACK-5263
http://secunia.com/advisories/55960
http://secunia.com/advisories/60284
http://support.citrix.com/article/CTX140989
http://www.securityfocus.com/bid/69432
http://www.securitytracker.com/id/1030762

Get alerted when CVE-2013-6398 or the next vulnerability affects your stack