Alex Perrakis

**Name of the Vulnerable Software and Affected Versions** OpenNebula Community Edition (CE) versions prior to 7.0.0 OpenNebula Enterprise Edition (EE) versions prior to 6.10.3 **Description** A critical race condition exists in FireEdge that can lead to full account takeover. An unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowing their credentials. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. **Recommendations** Update OpenNebula Community Edition (CE) to version 7.0.0 or later. Update OpenNebula Enterprise Edition (EE) to version 6.10.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A critical issue has been found, affecting the `create token` function of the API Token Handler component. This leads to improper access controls, allowing remote attacks. The issue has been publicly disclosed and may be exploited. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue. As a temporary workaround, consider restricting access to the `create token` function of the API Token Handler component until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A vulnerability was found in the function `session start response` of the file `src/mist/api/auth/middleware.py`. This issue leads to cross-site request forgery and can be initiated remotely. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A problematic issue has been found in the Authentication Endpoint component, specifically in the Login function of the file src/mist/api/views.py. The manipulation of the `return to` argument leads to cross-site scripting. This issue can be exploited remotely. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue.

**Name of the Vulnerable Software and Affected Versions** Mist Community Edition versions up to 4.7.1 **Description** A problem was found in the function `tag resources` of the file `src/mist/api/tag/views.py`. The manipulation of the argument `tag` leads to cross-site scripting. The attack may be initiated remotely. It is reported that the estimated number of potentially affected devices is not provided. **Recommendations** For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue. As a temporary workaround, consider restricting access to the `tag resources` function until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1 **Description** A critical vulnerability has been found in the Listing Handler component of the Summer Pearl Group Vacation Rental Management Platform, affecting unknown code and leading to authorization bypass. The attack can be initiated remotely. **Recommendations** For Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1, upgrade to version 1.0.2 to address this issue. It is recommended to upgrade the affected Listing Handler component.

The software that is vulnerable is Apache CloudStack, specifically versions from 4.16.0 onwards. The vulnerability is an access validation issue that allows unauthorized access to annotations, which can lead to potential loss of confidentiality of CloudStack environments and resources if the comments contain privileged information. An attacker with a user account and access or prior knowledge of resource UUIDs can exploit this issue to read contents of the comments or add malicious comments to resources. However, guessing or brute-forcing resource UUIDs is generally hard to impossible, and access to listing or adding comments isn't the same as access to CloudStack resources, making this issue of very low severity and general low impact. There is no public exploit available for this vulnerability, and it is not known to have been exploited by attackers. CloudStack admins can disallow listAnnotations and addAnnotation API access to non-admin roles as an interim measure to address this issue. #ApacheCloudStack #CVE202522828 #UnauthorisedAccess #Annotations #CloudSecurity #Vulnerability #LowSeverity #LowImpact