CVE-2024-13058CWE-269CWE-285CWE-400

Authenticated, non-admin users can create storage pools via the sifi API

Medium · published December 30, 2024

CVSS v4.0
4.8
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

An issue exists in SoftIron HyperCloud

where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem.

This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/S:N/AU:Y/R:U/V:D/RE:M/U:Green
EPSS
0.00443 · 37.5th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-285 · Improper Authorization; CWE-400 · Uncontrolled Resource Consumption
Published
2024-12-30T22:08Z
EPSS history
Timeline
  • 30 DEC 22:08Z
    Authenticated, non-admin users can create storage pools via the sifi API
    cvelistv5