{"api_version":"1","generated_at":"2026-07-23T06:08:18+00:00","cve":"CVE-2014-5040","urls":{"html":"https://cve.report/CVE-2014-5040","api":"https://cve.report/api/cve/CVE-2014-5040.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-5040","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-5040"},"summary":{"title":"CVE-2014-5040","description":"HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended access restrictions and modify arbitrary (1) access key credentials by leveraging knowledge of a key ID or (2) signing certificates by leveraging knowledge of a certificate ID.","state":"PUBLISHED","assigner":"mitre","published_at":"2016-01-05 02:59:00","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.6","severity":"","vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:P/I:P/A:P","baseScore":4.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463","name":"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"HPE Support document - HPE Support Center","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.eucalyptus.com/resources/security/advisories/esa-32","name":"https://www.eucalyptus.com/resources/security/advisories/esa-32","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5040","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5040","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"5040","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"eucalyptus","cpe5":"eucalyptus","cpe6":"4.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5040","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"eucalyptus","cpe5":"eucalyptus","cpe6":"4.2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T11:34:37.315Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.eucalyptus.com/resources/security/advisories/esa-32"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-07-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended access restrictions and modify arbitrary (1) access key credentials by leveraging knowledge of a key ID or (2) signing certificates by leveraging knowledge of a certificate ID."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-11-30T21:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.eucalyptus.com/resources/security/advisories/esa-32"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-5040","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended access restrictions and modify arbitrary (1) access key credentials by leveraging knowledge of a key ID or (2) signing certificates by leveraging knowledge of a certificate ID."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463","refsource":"CONFIRM","url":"https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04926463"},{"name":"https://www.eucalyptus.com/resources/security/advisories/esa-32","refsource":"CONFIRM","url":"https://www.eucalyptus.com/resources/security/advisories/esa-32"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-5040","datePublished":"2016-01-05T02:00:00.000Z","dateReserved":"2014-07-22T00:00:00.000Z","dateUpdated":"2024-08-06T11:34:37.315Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-01-05 02:59:00","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:P/I:P/A:P","baseScore":4.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:eucalyptus:eucalyptus:4.1.1:*:*:*:*:*:*:*","matchCriteriaId":"A00D8228-59F3-430A-BC8B-95E16591B597"},{"vulnerable":true,"criteria":"cpe:2.3:a:eucalyptus:eucalyptus:4.2.0:*:*:*:*:*:*:*","matchCriteriaId":"C43CF85C-9F9A-402A-ACF7-3C52A0618F13"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"5040","Ordinal":"1","Title":"CVE-2014-5040","CVE":"CVE-2014-5040","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"5040","Ordinal":"1","NoteData":"HP Helion Eucalyptus 4.1.x before 4.1.2 and HPE Helion Eucalyptus 4.2.x before 4.2.1 allow remote authenticated users to bypass intended access restrictions and modify arbitrary (1) access key credentials by leveraging knowledge of a key ID or (2) signing certificates by leveraging knowledge of a certificate ID.","Type":"Description","Title":"CVE-2014-5040"},{"CveYear":"2014","CveId":"5040","Ordinal":"2","NoteData":"2016-01-04","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"5040","Ordinal":"3","NoteData":"2016-11-30","Type":"Other","Title":"Modified"}]}}}