CVE-2022-26779

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-26779

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26779.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-26779

Aliases

GHSA-vpcc-9rh2-8jfp

Published

2022-03-15T15:40:11Z

Modified

2026-07-08T06:27:54.907125837Z

Summary

Apache Cloudstack insecure random number generation affects project email invitation

Details

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "Apache CloudStack"
                },
                {
                    "fixed": "4.16.1"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26779.json",
    "cna_assigner": "apache"
}

References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

Fixed

cad9332082a1f85eedc30cf547ae28224be170c2

Database specific

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.16.1.0"
        }
    ]
}

Affected versions

4.*

4.12.0.0

4.16.0.0

Other

acton-beta1-prerelease-1

ovm3

tag-3.*

tag-3.0.1-prerelease-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26779.json"