The VMware Broker in Eucalyptus 2.0.3 and 3.0.x before 3.0.2 does not properly authenticate SOAP requests, which allows remote attackers to execute arbitrary VMware Broker API commands.
| Software | From | Fixed in |
|---|---|---|
| eucalyptus / eucalyptus | 3.0.1 | 3.0.1.x |
| eucalyptus / eucalyptus | 2.0.3 | 2.0.3.x |