CVE-2016-3085

Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin.

CVSS v3 6.5 MEDIUM
CVSS v2.0 5.8 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html
http://www.securityfocus.com/archive/1/538636/100/0/threaded
http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html
http://www.securityfocus.com/archive/1/538636/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:cloudstack:4.7.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:apache:cloudstack:4.5.1:::::::*
	cpe:2.3:a:apache:cloudstack:4.5.2:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:apache:cloudstack:4.6.0:::::::*
	cpe:2.3:a:apache:cloudstack:4.6.1:::::::*
	cpe:2.3:a:apache:cloudstack:4.6.2:::::::*

Configuration 4 (hide)

cpe:2.3:a:apache:cloudstack:4.8:*:*:*:*:*:*:*

History

21 Nov 2024, 02:49

Type	Values Removed	Values Added
References	~~() http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html -~~	() http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html -
References	~~() http://www.securityfocus.com/archive/1/538636/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/538636/100/0/threaded -

Information

Published : 2016-06-10 15:59

Updated : 2024-11-21 02:49

NVD link : CVE-2016-3085

Mitre link : CVE-2016-3085

CVE.ORG link : CVE-2016-3085

JSON object : View

Products Affected

apache

cloudstack

CWE

CWE-254

7PK - Security Features

CWE-287

Improper Authentication

{"id": "CVE-2016-3085", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "published": "2016-06-10T15:59:02.360", "references": [{"url": "http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html", "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/archive/1/538636/100/0/threaded", "source": "secalert@redhat.com"}, {"url": "http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/538636/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}, {"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin."}, {"lang": "es", "value": "Apache CloudStack 4.5.x en versiones anteriores a 4.5.2.1, 4.6.x en versiones anteriores a 4.6.2.1, 4.7.x en versiones anteriores a 4.7.1.1 y 4.8.x en versiones anteriores a 4.8.0.1, cuando la autenticaci\u00f3n SAML-based est\u00e1 activa y en uso, permiten a atacantes remotos eludir la autenticaci\u00f3n y acceder a la interfaz de usuario a trav\u00e9s de vectores relacionados con el plugin SAML."}], "lastModified": "2024-11-21T02:49:20.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:4.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A7AE63F-5964-41B0-A8BA-6C1B37D568FA"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:4.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F03D7F22-2906-44E2-8BFA-9F47FC1860F0"}, {"criteria": "cpe:2.3:a:apache:cloudstack:4.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C46FF6A-EF32-4A62-8F92-3B91DD09A6A0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:4.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9267358-B059-4F79-9263-52E4AC7DA15F"}, {"criteria": "cpe:2.3:a:apache:cloudstack:4.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C607535D-3F5C-4DBE-8781-DA9CEF86F147"}, {"criteria": "cpe:2.3:a:apache:cloudstack:4.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CC8DF1C-0C43-4216-8C09-5D1484A9F5A4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1A01CFD-73DB-4E4F-9A79-4D4F6145F4E7"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}