CVE - CVE-2022-26779

CVE-ID
CVE-2022-26779	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp URL:https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp MISC:https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h URL:https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h MLIST:[oss-security] 20220315 CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation URL:http://www.openwall.com/lists/oss-security/2022/03/15/1
Assigning CNA
Apache Software Foundation
Date Record Created
20220309	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220309)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)