← Voltar para CVEs

CVE-2024-42222

MEDIUM

4.3

Descricao

In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data. Affected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1.

Detalhes CVE

Pontuacao CVSS v3.14.3

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado8/7/2024

Ultima modificacao3/14/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

apache:cloudstack

Fraquezas (CWE)

CWE-200

Referencias

https://cloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3(security@apache.org)

https://github.com/apache/cloudstack/issues/9456(security@apache.org)

https://lists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wlj(security@apache.org)

https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1/(security@apache.org)

http://www.openwall.com/lists/oss-security/2024/08/06/6(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.