CVEvulnerability
CVE-2023-46326
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-11-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-613
Description
ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation.
Affected configurations
• zstack zstack (<= 3.10.38)
Related
Weakness · not in database (1)
References
- https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q Exploit, Vendor Advisory
- https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q Exploit, Vendor Advisory