PT-2024-31652 · Apache · Apache Cloudstack

Fabrício Duarte · Published 2024-10-15 · Updated 2025-02-12 · CVE-2024-45461

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.7.0 through 4.18.2.3 Apache CloudStack versions 4.19.0.0 through 4.19.1.1

Description: The CloudStack Quota feature, which is disabled by default, allows cloud administrators to implement a quota or usage limit system for cloud resources. However, due to missing access check enforcements, non-administrative CloudStack user accounts can access and modify quota-related configurations and data when the feature is enabled.

Recommendations: For Apache CloudStack versions 4.7.0 through 4.18.2.3, upgrade to Apache CloudStack 4.18.2.4 or later. For Apache CloudStack versions 4.19.0.0 through 4.19.1.1, upgrade to Apache CloudStack 4.19.1.2 or later. Alternatively, users that do not use the Quota feature can disable the plugin by setting the global setting quota.enable.service to false.

Fix

Improper Privilege Management

Missing Authorization

Weakness Enumeration

CWE-269

CWE-862

Related Identifiers

CVE-2024-45461

Affected Products

Apache Cloudstack

References · 16

• https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45461 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45461 · Vendor Advisory
• https://shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-4-and-4-19-1-2 · Note
• https://twitter.com/oss_security/status/1846274796327510152 · Twitter Post
• https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 · Vendor Advisory, Patch
• https://t.me/cvenotify/98679 · Telegram Post
• https://twitter.com/fofabot/status/1846761556182507619 · Twitter Post
• https://t.me/cvenotify/111017 · Telegram Post
• https://twitter.com/CloudStack/status/1846408705132142871 · Twitter Post
• https://twitter.com/fletch_ai/status/1847185980098535480 · Twitter Post
• https://twitter.com/shapeblue/status/1846410929375678754 · Twitter Post
• http://openwall.com/lists/oss-security/2024/10/15/3 · Note
• https://t.me/cvedetector/8033 · Telegram Post
• https://twitter.com/CVEnew/status/1846466399788511474 · Twitter Post