CVE-2024-42222: apache software foundation apache cloudstack

Vulnerability summary

CVE-2024-42222 is a medium (CVSS 4.3) vulnerability in apache software foundation apache cloudstack. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-08-2024
   PublishedVulnerability first disclosed.
2. 14-03-2025
   Last modifiedVulnerability information updated.

Description

In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data. Affected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.