CVE-2024-29006 Vulnerability Details

  /     /     /  

CVE-2024-29006 Metadata Quick Info

CVE Published: 04/04/2024 | CVE Updated: 02/08/2024 | CVE Year: 2024
Source: apache | Vendor: Apache Software Foundation | Product: Apache CloudStack
Status : PUBLISHED

---

CVE-2024-29006 Description

By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-290
CWE Name: CWE-290 Authentication Bypass by Spoofing
Source: Apache Software Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).