CVE-2016-6813

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-06 · updated 2026-06-17

Description

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.

Affected products

Apache Software Foundation Apache CloudStack: from 4.1.0 through 4.8.1.0; 4.9.0

References

http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E
http://www.securityfocus.com/bid/93945
https://s.apache.org/qV5l
http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E
http://www.securityfocus.com/bid/93945
https://s.apache.org/qV5l

Get alerted when CVE-2016-6813 or the next vulnerability affects your stack