Auth bypass in Eucalyptus

CVE-2012-4066

The internal message protocol for Walrus in Eucalyptus 3.2.0 and earlier does not require signatures for unspecified request headers, which allows attackers to (1) delete or (2) upload snapshots.

Vulnerability class: Broken Authentication

EPSS: 0.011 (62.7th percentile) — read the EPSS interpretation.

Affected products

  • Eucalyptus — versions 1.0, 1.1, 1.2
  • N/a — versions n/a

Weakness classification (CWE)

References