CVE-2025-22829

Katalog CVE

CVSS 4.3 · Medium EPSS 0,82%

Kerentanan Improper Privilege Management pada apache cloudstack. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations. Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.

Rincian

Terbit di NVD

10 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60 mailing list · advisory vendor
• https://cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0 advisory pihak ketiga
• https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-... broken link