CVE-2010-3905 - Vulnerability Details - OpenCVE

The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Eucalyptus	Eucalyptus

Configuration 1 [-]

OR	cpe:2.3:a:eucalyptus:eucalyptus:2.0.0:::::::*
	cpe:2.3:a:eucalyptus:eucalyptus:2.0.1:::::::*

No data.

References

Link	Providers
http://open.eucalyptus.com/wiki/esa-01
http://secunia.com/advisories/42632
http://secunia.com/advisories/42666
http://www.securityfocus.com/bid/45462
http://www.ubuntu.com/usn/USN-1033-1
http://www.vupen.com/english/advisories/2010/3259
http://www.vupen.com/english/advisories/2010/3260
https://exchange.xforce.ibmcloud.com/vulnerabilities/64167

History

No history.

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2010-12-22T20:00:00

Updated: 2024-08-07T03:26:12.270Z

Reserved: 2010-10-12T00:00:00

Link: CVE-2010-3905

Vulnrichment

No data.

NVD

Status : Modified

Published: 2010-12-22T21:00:15.957

Modified: 2024-11-21T01:19:52.407

Link: CVE-2010-3905

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-12-16T00:00:00", "descriptions": [{"lang": "en", "value": "The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"name": "45462", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/45462"}, {"name": "USN-1033-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1033-1"}, {"name": "eucalyptus-adminui-security-bypass(64167)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64167"}, {"name": "42666", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/42666"}, {"name": "ADV-2010-3260", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/3260"}, {"name": "42632", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/42632"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://open.eucalyptus.com/wiki/esa-01"}, {"name": "ADV-2010-3259", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/3259"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "ID": "CVE-2010-3905", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "45462", "refsource": "BID", "url": "http://www.securityfocus.com/bid/45462"}, {"name": "USN-1033-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1033-1"}, {"name": "eucalyptus-adminui-security-bypass(64167)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64167"}, {"name": "42666", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/42666"}, {"name": "ADV-2010-3260", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/3260"}, {"name": "42632", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/42632"}, {"name": "http://open.eucalyptus.com/wiki/esa-01", "refsource": "CONFIRM", "url": "http://open.eucalyptus.com/wiki/esa-01"}, {"name": "ADV-2010-3259", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/3259"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T03:26:12.270Z"}, "title": "CVE Program Container", "references": [{"name": "45462", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/45462"}, {"name": "USN-1033-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-1033-1"}, {"name": "eucalyptus-adminui-security-bypass(64167)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64167"}, {"name": "42666", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/42666"}, {"name": "ADV-2010-3260", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/3260"}, {"name": "42632", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/42632"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://open.eucalyptus.com/wiki/esa-01"}, {"name": "ADV-2010-3259", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/3259"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2010-3905", "datePublished": "2010-12-22T20:00:00", "dateReserved": "2010-10-12T00:00:00", "dateUpdated": "2024-08-07T03:26:12.270Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E8974798-2246-4C12-A0A2-ADDB10563E58", "vulnerable": true}, {"criteria": "cpe:2.3:a:eucalyptus:eucalyptus:2.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "0C98920E-5369-4690-885A-BEE737F029C3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users."}, {"lang": "es", "value": "La caracter\u00edstica de borrado de password en la interfaz de administrador para Eucalyptus v2.0.0 y v2.0.1 no realiza la autenticaci\u00f3n, lo que permite a atacantes remotos obtener privilegios por env\u00edo de peticiones de borrado de password para otros usuarios. \r\n\r\n\r\n"}], "id": "CVE-2010-3905", "lastModified": "2024-11-21T01:19:52.407", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-12-22T21:00:15.957", "references": [{"source": "security@ubuntu.com", "url": "http://open.eucalyptus.com/wiki/esa-01"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42632"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42666"}, {"source": "security@ubuntu.com", "url": "http://www.securityfocus.com/bid/45462"}, {"source": "security@ubuntu.com", "url": "http://www.ubuntu.com/usn/USN-1033-1"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/3259"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/3260"}, {"source": "security@ubuntu.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64167"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://open.eucalyptus.com/wiki/esa-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42632"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/42666"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/45462"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-1033-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/3259"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/3260"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64167"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}