Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder seine Privilegien zu erhöhen.
Product
Apache CloudStack ist eine Sofwareplattform zum Verwalten großer Netzwerke von virtuellen Maschienen als eine hoch verfügbare, hoch skalierbare Infrastructure as a Service (IaaS) Cloud Computing Plattform. CloudStack wurde von Citrix entwicklet und anschließend über Apache als Open Source Software zur Verfügung gestellt.
Vulnerabilities 4
-
High 8.5
Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure
Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks to their existing instances. Due to missing validation checks for KVM-compatible templates or volum…
-
High 8.0
Apache CloudStack: Request origin validation bypass makes account takeover possible
Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users …
-
Medium 6.3
Apache CloudStack: Incomplete session invalidation on web interface logout
The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access…
-
Medium 5.7
Apache CloudStack Quota plugin: Access checks not enforced in Quota
The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative Clo…
Revision history
-
#1
Initiale Fassung
References
-
CloudStack Security Advisory vom 2024-10-15
https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2