PT-2024-31729 · Apache · Apache Cloudstack

Arthur Souza + 1 · Published 2024-10-15 · Updated 2024-10-21 · CVE-2024-45693

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache CloudStack versions 4.15.1.0 through 4.18.2.3 Apache CloudStack versions 4.19.0.0 through 4.19.1.1

Description: The issue allows attackers to trick users logged into the Apache CloudStack's web interface into submitting malicious CSRF requests due to missing validation of the origin of the requests. This can lead to account takeover, disruption, exposure of sensitive data, and compromise of the integrity of resources owned by the user account managed by the platform.

Recommendations: For Apache CloudStack versions 4.15.1.0 through 4.18.2.3, upgrade to Apache CloudStack 4.18.2.4 or later. For Apache CloudStack versions 4.19.0.0 through 4.19.1.1, upgrade to Apache CloudStack 4.19.1.2 or later. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-45693

Affected Products

Apache Cloudstack

References · 17

• https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45693 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45693 · Security Note
• https://twitter.com/pravin_karthik/status/1846832905550811453 · Twitter Post
• https://twitter.com/CVEnew/status/1846466402099593533 · Twitter Post
• https://t.me/latest_high_impact_cve/1338 · Telegram Post
• https://twitter.com/fofabot/status/1846761556182507619 · Twitter Post
• http://openwall.com/lists/oss-security/2024/10/15/5 · Note
• https://twitter.com/CloudStack/status/1846408705132142871 · Twitter Post
• https://twitter.com/cracbot/status/1848242920060866582 · Twitter Post
• https://twitter.com/oss_security/status/1846274798785384864 · Twitter Post
• https://twitter.com/fletch_ai/status/1847185980098535480 · Twitter Post
• https://twitter.com/shapeblue/status/1846410929375678754 · Twitter Post
• https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 · Patch, Vendor Advisory
• https://t.me/cvedetector/8026 · Telegram Post