PT-2024-5718 · Apache · Apache Cloudstack

Christian Gross + 1 · Published 2024-08-06 · Updated 2024-08-29 · CVE-2024-42222

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache CloudStack version 4.19.1.0

Description The issue is related to a regression in the network listing API, allowing unauthorized list access of network details for domain admin and normal user accounts. This compromises tenant isolation, potentially leading to unauthorized access to network details, configurations, and data.

Recommendations For Apache CloudStack version 4.19.1.0, upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering an upgrade can skip version 4.19.1.0 and upgrade directly to 4.19.1.1.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-06431

CVE-2024-42222

Affected Products

Apache Cloudstack

References · 11

• 🔥 https://github.com/apache/cloudstack/issues/9456 · Exploit
• https://bdu.fstec.ru/vul/2024-06431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42222 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42222 · Vendor Advisory
• https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj · Vendor Advisory
• http://openwall.com/lists/oss-security/2024/08/06/6 · Note
• https://shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1 · Note
• https://t.me/cvenotify/89591 · Telegram Post
• https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3 · Vendor Advisory, Patch
• https://t.me/cvedetector/2675 · Telegram Post
• https://t.me/pentestingnews/50097 · Telegram Post