Vulnerability-Lookup

CVE-2022-26779 (GCVE-0-2022-26779)

Vulnerability from cvelistv5 – Published: 2022-03-15 15:40 – Updated: 2024-08-03 05:11

Title

Apache Cloudstack insecure random number generation affects project email invitation

Summary

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.

Severity

No CVSS data available.

CWE

anonymous invite can be used by anyone

Assigner

apache CNA under the mitre root

CNA scorecard B 76/100 over 1259 records in the last 180 days details

References

3 references

URL	Tags
https://lists.apache.org/thread/dmm07b1cyosovqr12…	x_refsource_MISC
https://github.com/JLLeitschuh/security-research/…	x_refsource_MISC
http://www.openwall.com/lists/oss-security/2022/03/15/1	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache CloudStack	Affected: Apache CloudStack , < 4.16.1 (custom)	guessed

Credits

This issue was reported by Jonathan Leitschuh

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:11:45.092Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
          },
          {
            "name": "[oss-security] 20220315 CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache CloudStack",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.16.1",
              "status": "affected",
              "version": "Apache CloudStack",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was reported by Jonathan Leitschuh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "anonymous invite can be used by anyone",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-15T17:06:15.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
        },
        {
          "name": "[oss-security] 20220315 CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Cloudstack insecure random number generation affects project email invitation",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-26779",
          "STATE": "PUBLIC",
          "TITLE": "Apache Cloudstack insecure random number generation affects project email invitation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache CloudStack",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Apache CloudStack",
                            "version_value": "4.16.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was reported by Jonathan Leitschuh"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {
            "other": "low"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "anonymous invite can be used by anyone"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
            },
            {
              "name": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp",
              "refsource": "MISC",
              "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
            },
            {
              "name": "[oss-security] 20220315 CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-26779",
    "datePublished": "2022-03-15T15:40:11.000Z",
    "dateReserved": "2022-03-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T05:11:45.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-26779",
      "date": "2026-11-15",
      "epss": "0.0285",
      "percentile": "0.86935"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Apache CloudStack",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "4.16.1",
                    "status": "affected",
                    "version": "Apache CloudStack",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2FA5F54-22BD-4CF9-9678-CB0A022749C8",
                    "versionEndExcluding": "4.16.1.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack."
          },
          {
            "lang": "es",
            "value": "Apache CloudStack versiones anteriores a 4.16.1.0, usaba una generaci\u00f3n no segura de n\u00fameros aleatorios para los tokens de invitaci\u00f3n a proyectos. Si se crea una invitaci\u00f3n a un proyecto bas\u00e1ndose \u00fanicamente en una direcci\u00f3n de correo electr\u00f3nico, es generado un token aleatorio. Un atacante con conocimiento del ID del proyecto y el hecho de que la invitaci\u00f3n es enviada, podr\u00eda generar tokens deterministas en el tiempo e intentar por fuerza bruta usarlos antes de que el receptor leg\u00edtimo acepte la invitaci\u00f3n. Esta funci\u00f3n no est\u00e1 habilitada por defecto, el atacante debe conocer o adivinar el ID del proyecto para la invitaci\u00f3n, adem\u00e1s del token de invitaci\u00f3n, y el atacante tendr\u00eda que ser un usuario autorizado existente de CloudStack"
          }
        ],
        "id": "CVE-2022-26779",
        "lastModified": "2026-06-17T04:35:48.100",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "HIGH",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.6,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-03-15T16:15:09.563",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Exploit",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-338"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T12:38:19+00:00",
      "cve": "CVE-2022-26779",
      "id": "CVE-2022-26779",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Apache Cloudstack insecure random number generation affects project email invitation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-26779.json",
      "version": "3"
    }
  }
}

CNVD-2022-76241

Vulnerability from cnvd - Published: 2022-11-11

Title

Apache CloudStack安全特征问题漏洞

Description

Apache CloudStack是美国阿帕奇（Apache）基金会的一套基础架构即服务（IaaS）云计算平台。该平台主要用于部署和管理大型虚拟机网络。 Apache CloudStack 4.16.1.0之前版本存在安全特征问题漏洞，该漏洞源于Apache CloudStack不安全的随机数生成影响项目电子邮件邀请。攻击者可利用该漏洞攻击者成具有时间确定性的令牌，并在合法接收方接受邀请之前使用这些令牌。

Severity

中

Patch Name

Apache CloudStack安全特征问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： http://www.openwall.com/lists/oss-security/2022/03/15/1

Reference

https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp

Impacted products

Name
Apache Apache CloudStack <4.16.1.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-26779",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-26779"
    }
  },
  "description": "Apache CloudStack\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u57fa\u7840\u67b6\u6784\u5373\u670d\u52a1\uff08IaaS\uff09\u4e91\u8ba1\u7b97\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3b\u8981\u7528\u4e8e\u90e8\u7f72\u548c\u7ba1\u7406\u5927\u578b\u865a\u62df\u673a\u7f51\u7edc\u3002\n\nApache CloudStack 4.16.1.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eApache CloudStack\u4e0d\u5b89\u5168\u7684\u968f\u673a\u6570\u751f\u6210\u5f71\u54cd\u9879\u76ee\u7535\u5b50\u90ae\u4ef6\u9080\u8bf7\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u653b\u51fb\u8005\u6210\u5177\u6709\u65f6\u95f4\u786e\u5b9a\u6027\u7684\u4ee4\u724c\uff0c\u5e76\u5728\u5408\u6cd5\u63a5\u6536\u65b9\u63a5\u53d7\u9080\u8bf7\u4e4b\u524d\u4f7f\u7528\u8fd9\u4e9b\u4ee4\u724c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www.openwall.com/lists/oss-security/2022/03/15/1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-76241",
  "openTime": "2022-11-11",
  "patchDescription": "Apache CloudStack\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u57fa\u7840\u67b6\u6784\u5373\u670d\u52a1\uff08IaaS\uff09\u4e91\u8ba1\u7b97\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3b\u8981\u7528\u4e8e\u90e8\u7f72\u548c\u7ba1\u7406\u5927\u578b\u865a\u62df\u673a\u7f51\u7edc\u3002\r\n\r\nApache CloudStack 4.16.1.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eApache CloudStack\u4e0d\u5b89\u5168\u7684\u968f\u673a\u6570\u751f\u6210\u5f71\u54cd\u9879\u76ee\u7535\u5b50\u90ae\u4ef6\u9080\u8bf7\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u653b\u51fb\u8005\u6210\u5177\u6709\u65f6\u95f4\u786e\u5b9a\u6027\u7684\u4ee4\u724c\uff0c\u5e76\u5728\u5408\u6cd5\u63a5\u6536\u65b9\u63a5\u53d7\u9080\u8bf7\u4e4b\u524d\u4f7f\u7528\u8fd9\u4e9b\u4ee4\u724c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache CloudStack\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Apache CloudStack \u003c4.16.1.0"
  },
  "referenceLink": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp",
  "serverity": "\u4e2d",
  "submitTime": "2022-03-21",
  "title": "Apache CloudStack\u5b89\u5168\u7279\u5f81\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2022-26779

Vulnerability from fkie_nvd - Published: 2022-03-15 16:15 - Updated: 2026-06-17 04:35

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@apache.org	http://www.openwall.com/lists/oss-security/2022/03/15/1	Mailing List, Third Party Advisory
security@apache.org	https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp	Exploit, Patch, Third Party Advisory
security@apache.org	https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h	Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2022/03/15/1	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp	Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h	Mailing List, Vendor Advisory

Impacted products

	Vendor	Product	Version
	apache	cloudstack	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Apache CloudStack",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.16.1",
              "status": "affected",
              "version": "Apache CloudStack",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2FA5F54-22BD-4CF9-9678-CB0A022749C8",
              "versionEndExcluding": "4.16.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack."
    },
    {
      "lang": "es",
      "value": "Apache CloudStack versiones anteriores a 4.16.1.0, usaba una generaci\u00f3n no segura de n\u00fameros aleatorios para los tokens de invitaci\u00f3n a proyectos. Si se crea una invitaci\u00f3n a un proyecto bas\u00e1ndose \u00fanicamente en una direcci\u00f3n de correo electr\u00f3nico, es generado un token aleatorio. Un atacante con conocimiento del ID del proyecto y el hecho de que la invitaci\u00f3n es enviada, podr\u00eda generar tokens deterministas en el tiempo e intentar por fuerza bruta usarlos antes de que el receptor leg\u00edtimo acepte la invitaci\u00f3n. Esta funci\u00f3n no est\u00e1 habilitada por defecto, el atacante debe conocer o adivinar el ID del proyecto para la invitaci\u00f3n, adem\u00e1s del token de invitaci\u00f3n, y el atacante tendr\u00eda que ser un usuario autorizado existente de CloudStack"
    }
  ],
  "id": "CVE-2022-26779",
  "lastModified": "2026-06-17T04:35:48.100",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-03-15T16:15:09.563",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2022-26779

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-26779

Aliases

CVE-2022-26779

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-26779",
    "description": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.",
    "id": "GSD-2022-26779"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-26779"
      ],
      "details": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.",
      "id": "GSD-2022-26779",
      "modified": "2023-12-13T01:19:39.560749Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "ID": "CVE-2022-26779",
        "STATE": "PUBLIC",
        "TITLE": "Apache Cloudstack insecure random number generation affects project email invitation"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Apache CloudStack",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "Apache CloudStack",
                          "version_value": "4.16.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apache Software Foundation"
            }
          ]
        }
      },
      "credit": [
        {
          "lang": "eng",
          "value": "This issue was reported by Jonathan Leitschuh"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": [
        {
          "other": "low"
        }
      ],
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "anonymous invite can be used by anyone"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
          },
          {
            "name": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp",
            "refsource": "MISC",
            "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
          },
          {
            "name": "[oss-security] 20220315 CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,4.16.1.0)",
          "affected_versions": "All versions before 4.16.1.0",
          "cvss_v2": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-338",
            "CWE-937"
          ],
          "date": "2022-03-22",
          "description": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.",
          "fixed_versions": [
            "4.16.1.0"
          ],
          "identifier": "CVE-2022-26779",
          "identifiers": [
            "CVE-2022-26779",
            "GHSA-vpcc-9rh2-8jfp"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.apache.cloudstack/cloudstack",
          "pubdate": "2022-03-15",
          "solution": "Upgrade to version 4.16.1.0 or above.",
          "title": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-26779",
            "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h",
            "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp",
            "http://www.openwall.com/lists/oss-security/2022/03/15/1"
          ],
          "uuid": "49e1ff64-abe3-481f-b803-bd36c1fd0a70"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.16.1.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-26779"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-338"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h",
              "refsource": "MISC",
              "tags": [
                "Mailing List",
                "Vendor Advisory"
              ],
              "url": "https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h"
            },
            {
              "name": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp"
            },
            {
              "name": "[oss-security] 20220315 CVE-2022-26779: Apache Cloudstack insecure random number generation affects project email invitation",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2022/03/15/1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-03-22T16:09Z",
      "publishedDate": "2022-03-15T16:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-26779 (GCVE-0-2022-26779)

CNVD-2022-76241

FKIE_CVE-2022-26779

GSD-2022-26779

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour