PT-2025-48264 · Apache · Apache Cloudstack

Published 2025-11-27 · Updated 2025-12-04 · CVE-2025-59302

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0 through 4.20.1 Apache CloudStack versions 4.21.0 through 4.21.9

Description An improper control of code generation ('Code Injection') issue exists in Apache CloudStack, specifically within several APIs accessible only to administrators. These APIs include quotaTariffCreate, quotaTariffUpdate, createSecondaryStorageSelector, updateSecondaryStorageSelector, updateHost, and updateHost. The issue allows for potential code injection due to insufficient control over code generation. A new global configuration flag, js.interpretation.enabled, has been introduced to control JavaScript expression interpretation in these APIs, mitigating the risk.

Recommendations Upgrade to Apache CloudStack version 4.20.2 or later. Upgrade to Apache CloudStack version 4.22.0 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-59302

Affected Products

Apache Cloudstack

References · 10

• https://osv.dev/vulnerability/CVE-2025-59302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59302 · Security Note
• https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788 · Vendor Advisory
• https://twitter.com/oss_security/status/1996686871926395129 · Twitter Post
• https://twitter.com/dailycve/status/1995886402563866679 · Twitter Post
• https://twitter.com/pigram86/status/1994016717811429700 · Twitter Post
• https://t.me/CVEtracker/38387 · Telegram Post
• https://t.me/cveNotify/144236 · Telegram Post
• https://twitter.com/CVEnew/status/1994021423577247786 · Twitter Post
• http://openwall.com/lists/oss-security/2025/11/27/2 · Note