CVE-2022-26779

    Dashboard / Vulnerabilities / CVE-2022-26779

    CVE-2022-26779

    Published: 15 Mar 2022Last Modified: 24 Oct 2026

    Summary: Apache Cloudstack insecure random number generation affects project email invitation

    Details: Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.

    References: https://lists.apache.org/thread/dmm07b1cyosovqr12ddhkko501p11h2h, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26779.json, https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-vpcc-9rh2-8jfp, https://nvd.nist.gov/vuln/detail/CVE-2022-26779, http://www.openwall.com/lists/oss-security/2022/03/15/1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cad9332082a1f85eedc30cf547ae28224be170c2

    Affected versions

    4.16.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-26779 | CVE-DB