Aller au contenu
en Se connecter
4.7 Moyenne

CVE-2025-30675 In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs

Description

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain. A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.  This vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain. Affected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache CloudStack 4.20 4.20.0.0 → < 4.20.1.0 4.20.1.0
Apache CloudStack 4.0 4.0.0 → < 4.19.3.0 4.19.3.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache CloudStack

Les 51 CVE de Apache CloudStack →
CVE-2026-59654 Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration… 6.8 Moyenne CVE-2026-47359 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache… Non notée CVE-2026-50112 SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an… Non notée CVE-2026-50222 Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's… Non notée
Suivre cette CVE