CyberRota Analysis
AI-GeneratedOpenNebula systems prior to version 7.4 are vulnerable due to improper access controls, allowing authenticated users with basic permissions to execute commands on other users' virtual machines through the `one.vm.exec` function. This exploitation can lead to significant risks, including unauthorized access and potential compromise of the confidentiality, integrity, and availability of the affected virtual machines. Organizations using OpenNebula should prioritize patching to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.