Description
In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the user is able to see information for accounts other than their own.
Remediation
References
http://seclists.org/oss-sec/2018/q1/1
Related Vulnerabilities
CVE-2023-35887 Vulnerability in maven package org.apache.sshd:sshd-sftp
CVE-2022-43411 Vulnerability in maven package org.jenkins-ci.plugins:gitlab-plugin
CVE-2023-27095 Vulnerability in maven package cn.hippo4j:hippo4j-core
CVE-2013-4590 Vulnerability in maven package org.apache.tomcat:catalina-ant
CVE-2020-17527 Vulnerability in maven package org.apache.tomcat:tomcat-coyote