CVE-2024-45461: apache software foundation apache cloudstack quota plugin Missing Authorization
Vulnerability summary
CVE-2024-45461 is a medium (CVSS 6.3) Missing Authorization vulnerability in apache software foundation apache cloudstack quota plugin. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.8% of scored vulnerabilities.
Timeline
- 16-10-2024PublishedVulnerability first disclosed.
- 21-02-2025Last modifiedVulnerability information updated.
Description
The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false".
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.7MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:LDiffers
EPSS trend
Probability
0.77%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
+0.04 pp
From 0.73% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- cloudstack≥ 4.7.0, < 4.18.2.4 | ≥ 4.19.0.0, < 4.19.1.2
Apache software foundation1 product
- apache cloudstack quota plugin≥ 4.7.0, ≤ 4.18.2.3 | ≥ 4.19.0.0, ≤ 4.19.1.1
2 vendors · 2 products