Description
In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.
* quotaTariffCreate
* quotaTariffUpdate
* createSecondaryStorageSelector
* updateSecondaryStorageSelector
* updateHost
* updateStorage
This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.
The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.18.0 – < 4.20.2, 4.21.0 – < 4.22.0 | 4.20.2 |
Advisories 1
- WID-SEC-2025-2687 Apache CloudStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 27, 2025
References
- https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788 vendor-advisory