CyberRota Analysis
AI-GeneratedWebVirtCloud has a vulnerability that improperly validates permission flags in UserInstance grants, enabling users with view-only access to execute privileged actions. This flaw allows attackers to power off virtual machines, reset root passwords, install SSH keys, and manage ISO images, posing significant risks to system integrity and availability. Organizations using WebVirtCloud should prioritize addressing this issue to prevent unauthorized access and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.