CVE-2024-39864: apache software foundation apache cloudstack Code Injection
Vulnerability summary
CVE-2024-39864 is a critical (CVSS 9.8) Code Injection vulnerability in apache software foundation apache cloudstack. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities.
Timeline
- 05-07-2024PublishedVulnerability first disclosed.
- 19-03-2025Last modifiedVulnerability information updated.
Description
The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for testing purposes. By default, the integration API service port is disabled and is considered disabled when integration.api.port is set to 0 or negative. Due to an improper initialisation logic, the integration API service would listen on a random port when its port value is set to 0 (default value). An attacker that can access the CloudStack management network could scan and find the randomised integration API service port and exploit it to perform unauthorised administrative actions and perform remote code execution on CloudStack managed hosts and result in complete compromise of the confidentiality, integrity, and availability of CloudStack managed infrastructure. Users are recommended to restrict the network access on the CloudStack management server hosts to only essential ports. Users are recommended to upgrade to version 4.18.2.1, 4.19.0.2 or later, which addresses this issue.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.77%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.77% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-665Improper InitializationThe product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Affected systems
Apache1 product
- cloudstack≥ 4.0.0, < 4.18.2.1 | ≥ 4.19.0.0, < 4.19.0.2
Apache software foundation1 product
- apache cloudstack≥ 4.0.0, ≤ 4.18.2.0 | ≥ 4.19.0.0, ≤ 4.19.0.1
2 vendors · 2 products
References
4 links- cloudstack.apache.org/blog/security-release-advisory-4.19.0.2-4.18.2.1Vendor AdvisoryPatchRelease Notes
- www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-1-and-4-19-0-2Third Party AdvisoryRelease Notes
- www.openwall.com/lists/oss-security/2024/07/05/1Mailing List