CVE-2012-5616

no score yetEPSS 0.6%

No CVSS score yet. EPSS 0.6% chance of exploitation in the next 30 days.

Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-255
Published: 2013-01-22
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

apache:cloudstack
citrix:cloudplatform

References

http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E
http://osvdb.org/89070
http://osvdb.org/89146
http://osvdb.org/89147
http://seclists.org/fulldisclosure/2013/Jan/65

Check your stack JSON