VulnerabilityModified
CVE-2015-3251
Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls.
MEDIUM 4.9EPSS 2.45%
Does this matter?
Lower severity and a low EPSS score (2.45%). Track it; it rarely justifies an emergency change on its own.
Description
Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls.
- CVSS 3.0
- 4.9 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.45% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- apache/cloudstack
- Source
- secalert@redhat.com
References
- http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C94DD4CB4-F718-4F79-A934-3D677E497114%40gmail.com%3EVendor Advisory
- http://www.securityfocus.com/archive/1/537458/100/0/threaded
- https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisoriesVendor Advisory
- http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C94DD4CB4-F718-4F79-A934-3D677E497114%40gmail.com%3EVendor Advisory
- http://www.securityfocus.com/archive/1/537458/100/0/threaded
- https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisoriesVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.