Skip to main content

Cloudstack CVE-2024-45461

MEDIUM
Missing Authorization (CWE-862)
2024-10-16 security@apache.org
Authentication Bypass Apache Cloudstack
6.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Oct 16, 2024 - 08:15 nvd
MEDIUM 6.3

DescriptionNVD

The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled.

Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false".

AnalysisAI

The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false". Affected products include: Apache Cloudstack. Version information: through 4.18.2.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

More in Cloudstack

View all
CVE-2024-41107 HIGH POC
8.1 Jul 19

The CloudStack SAML authentication (disabled by default) does not enforce signature check. Rated high severity (CVSS 8.1
CVE-2022-26779 HIGH POC
7.5 Mar 15

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. Rated high sev
CVE-2012-4501 CRITICAL
10.0 Oct 26

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by l
CVE-2015-3252 CRITICAL
9.8 Feb 08

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allow
CVE-2024-50386 CRITICAL
9.9 Nov 12

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary
CVE-2024-39864 CRITICAL
9.8 Jul 05

The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configur
CVE-2024-38346 CRITICAL
9.8 Jul 05

The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands
CVE-2024-29006 CRITICAL
9.8 Apr 04

By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an A
CVE-2022-35741 CRITICAL
9.8 Jul 18

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vul
CVE-2025-47849 HIGH
8.8 Jun 10

A privilege escalation vulnerability in Apache CloudStack (CVSS 8.8) that allows the attacker. High severity vulnerabili
CVE-2025-47713 HIGH
8.8 Jun 10

A privilege escalation vulnerability in Apache CloudStack (CVSS 8.8) that allows the attacker. High severity vulnerabili
CVE-2024-45693 HIGH
8.8 Oct 16

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2024-45461 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy