{"api_version":"1","generated_at":"2026-07-23T09:09:38+00:00","cve":"CVE-2012-5616","urls":{"html":"https://cve.report/CVE-2012-5616","api":"https://cve.report/api/cve/CVE-2012-5616.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-5616","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-5616"},"summary":{"title":"CVE-2012-5616","description":"Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.","state":"PUBLISHED","assigner":"redhat","published_at":"2013-01-22 23:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-255","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"1.5","severity":"","vector":"AV:L/AC:M/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:L/AC:M/Au:S/C:P/I:N/A:N","baseScore":1.5,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2013/Jan/65","name":"http://seclists.org/fulldisclosure/2013/Jan/65","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: [CVE-2012-5616] Apache CloudStack information\tdisclosure vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/89146","name":"http://osvdb.org/89146","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/89147","name":"http://osvdb.org/89147","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://osvdb.org/89070","name":"http://osvdb.org/89070","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/51821","name":"http://secunia.com/advisories/51821","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA51821 - Apache CloudStack Log File Multiple Information Disclosure Weaknesses - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/57259","name":"http://www.securityfocus.com/bid/57259","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apache CloudStack CVE-2012-5616 Local Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://support.citrix.com/article/CTX136163","name":"http://support.citrix.com/article/CTX136163","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"404 - Page not found","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E","name":"http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CVE-2012-5616: Apache CloudStack information disclosure vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51827","name":"http://secunia.com/advisories/51827","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA51827 - Citrix CloudPlatform Log File Multiple Information Disclosure Weaknesses - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/57225","name":"http://www.securityfocus.com/bid/57225","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Call of Duty Elite for iOS CVE-2012-4918 SSL Certificate Validation Spoofing Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id?1027978","name":"http://www.securitytracker.com/id?1027978","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Citrix CloudPlatform Logs Potentially Sensitive Information in the Log File - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/51366","name":"http://secunia.com/advisories/51366","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA51366 - Call of Duty Elite for iOS Certificate Verification Security Issue - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565@stratosec.co%3E","name":"MLIST:[incubator-cloudstack-users] 20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","refsource":"MITRE","tags":[],"title":"CVE-2012-5616: Apache CloudStack information disclosure vulnerability","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-5616","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5616","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"5616","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"cloudstack","cpe6":"4.0.0","cpe7":"incubating","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"5616","vulnerable":"1","versionEndIncluding":"3.0.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"cloudplatform","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T21:14:16.356Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.citrix.com/article/CTX136163"},{"name":"89146","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/89146"},{"name":"20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2013/Jan/65"},{"name":"89147","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/89147"},{"name":"57225","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/57225"},{"name":"[incubator-cloudstack-users] 20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E"},{"name":"51821","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51821"},{"name":"57259","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/57259"},{"name":"89070","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/89070"},{"name":"51366","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51366"},{"name":"51827","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/51827"},{"name":"1027978","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1027978"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-01-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2013-03-30T09:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://support.citrix.com/article/CTX136163"},{"name":"89146","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/89146"},{"name":"20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2013/Jan/65"},{"name":"89147","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/89147"},{"name":"57225","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/57225"},{"name":"[incubator-cloudstack-users] 20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","tags":["mailing-list","x_refsource_MLIST"],"url":"http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565%40stratosec.co%3E"},{"name":"51821","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51821"},{"name":"57259","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/57259"},{"name":"89070","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/89070"},{"name":"51366","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51366"},{"name":"51827","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/51827"},{"name":"1027978","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1027978"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2012-5616","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://support.citrix.com/article/CTX136163","refsource":"CONFIRM","url":"http://support.citrix.com/article/CTX136163"},{"name":"89146","refsource":"OSVDB","url":"http://osvdb.org/89146"},{"name":"20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2013/Jan/65"},{"name":"89147","refsource":"OSVDB","url":"http://osvdb.org/89147"},{"name":"57225","refsource":"BID","url":"http://www.securityfocus.com/bid/57225"},{"name":"[incubator-cloudstack-users] 20130110 CVE-2012-5616: Apache CloudStack information disclosure vulnerability","refsource":"MLIST","url":"http://mail-archives.apache.org/mod_mbox/incubator-cloudstack-users/201301.mbox/%3C1BD2169F-BBFE-4E27-B50F-F17D7D08B565@stratosec.co%3E"},{"name":"51821","refsource":"SECUNIA","url":"http://secunia.com/advisories/51821"},{"name":"57259","refsource":"BID","url":"http://www.securityfocus.com/bid/57259"},{"name":"89070","refsource":"OSVDB","url":"http://osvdb.org/89070"},{"name":"51366","refsource":"SECUNIA","url":"http://secunia.com/advisories/51366"},{"name":"51827","refsource":"SECUNIA","url":"http://secunia.com/advisories/51827"},{"name":"1027978","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1027978"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2012-5616","datePublished":"2013-01-22T23:00:00.000Z","dateReserved":"2012-10-24T00:00:00.000Z","dateUpdated":"2024-08-06T21:14:16.356Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-01-22 23:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-255","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:S/C:P/I:N/A:N","baseScore":1.5,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":2.7,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:cloudstack:4.0.0:incubating:*:*:*:*:*:*","matchCriteriaId":"EA46B1B9-FCD7-4F3D-88E6-95B1A5A0497C"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:cloudplatform:*:*:*:*:*:*:*:*","versionEndIncluding":"3.0.5","matchCriteriaId":"B7802906-7538-4434-B1F9-89C10ECE8A3E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"5616","Ordinal":"1","Title":"CVE-2012-5616","CVE":"CVE-2012-5616","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"5616","Ordinal":"1","NoteData":"Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain (1) the SSH private key as recorded by the createSSHKeyPair API, (2) the password of an added host as recorded by the AddHost API, or the password of an added VM as recorded by the (3) DeployVM or (4) ResetPasswordForVM API.","Type":"Description","Title":"CVE-2012-5616"},{"CveYear":"2012","CveId":"5616","Ordinal":"2","NoteData":"2013-01-22","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"5616","Ordinal":"3","NoteData":"2013-03-30","Type":"Other","Title":"Modified"}]}}}