Description
The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.9.1.0 – ≤ 4.18.1.0, 4.19.0.0 | — |
Advisories 1
- WID-SEC-2024-0802 Apache CloudStack: Mehrere Schwachstellen ermöglichen Privilegieneskalation BSI CERT-Bund (WID) · Nov 27, 2024
References
- https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp vendor-advisory