PT-2025-48265 · Apache · Apache Cloudstack

[e-mail] · Published 2025-11-27 · Updated 2025-12-04 · CVE-2025-59454

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions prior to 4.20.2.0 Apache CloudStack versions prior to 4.22.0.0

Description A flaw in access control checks within Apache CloudStack allowed authorized users to potentially access information beyond their intended scope. This issue affected several APIs, including createNetworkACL, listNetworkACLs, listResourceDetails, listVirtualMachinesUsageHistory, and listVolumesUsageHistory. Insufficient permission validation was identified as the root cause.

Recommendations Upgrade to Apache CloudStack version 4.20.2.0. Upgrade to Apache CloudStack version 4.22.0.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-59454

Affected Products

Apache Cloudstack

References · 9

• https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59454 · Security Note
• https://twitter.com/CVEnew/status/1994011005328728304 · Twitter Post
• https://twitter.com/oss_security/status/1996686871926395129 · Twitter Post
• https://twitter.com/pigram86/status/1994016717811429700 · Twitter Post
• http://openwall.com/lists/oss-security/2025/11/27/3 · Note
• https://t.me/CVEtracker/38388 · Telegram Post
• https://twitter.com/dailycve/status/1995885582892097577 · Twitter Post