EUVD-2025-209742
GHSA-jp26-gvwc-cc96
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs.
Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
AnalysisAI
Authenticated CloudStack users can hijack volumes from other tenants' backups via the Backup plugin in versions 4.21.0.0 and 4.22.0.0. Attackers with low-privileged authenticated access can restore any user's backup volume and attach it to their own VMs, enabling complete data theft across tenant boundaries in multi-tenant environments. CVSS 8.1 reflects high confidentiality and integrity impact with low attack complexity. EPSS score of 0.01% indicates minimal observed exploitation activity, while SSVC assessment confirms non-automatable, partial technical impact with no known exploitation. Apache released patch version 4.22.0.1 addressing the access control flaw.
Technical ContextAI
Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) platform for deploying and managing large networks of virtual machines across multiple hypervisors. The Backup plugin, introduced in version 4.21.0.0, provides snapshot and backup management capabilities for VM volumes. This vulnerability stems from CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), manifesting as improper authorization checks in the plugin's API endpoints. The flaw allows horizontal privilege escalation across tenant boundaries - authenticated users can invoke backup restoration APIs without proper ownership validation, enabling cross-account data access. The CPE string cpe:2.3:a:apache_software_foundation:apache_cloudstack:*:*:*:*:*:*:*:* confirms Apache Software Foundation as the vendor, with versions 4.21.0.0 through 4.22.0.0 affected when the Backup plugin is enabled.
RemediationAI
Upgrade to Apache CloudStack version 4.22.0.1, which resolves the access control flaw per vendor advisory at https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm. Organizations unable to immediately upgrade should implement compensating controls: disable the CloudStack Backup plugin entirely if not operationally required (eliminates attack surface but removes backup functionality); implement strict API access monitoring and alerting for backup restoration operations, flagging any restore requests that cross tenant boundaries; apply principle of least privilege by auditing and restricting user accounts to minimum necessary API permissions; consider network segmentation to limit authenticated user access to CloudStack management APIs only from trusted networks. Note that disabling the plugin may disrupt existing backup workflows requiring operational planning. Audit existing volume attachments to detect potential prior exploitation by reviewing CloudStack logs for anomalous backup restoration activities between account creation and patch deployment.
More in Apache Cloudstack
View allCross-tenant manipulation in Apache CloudStack's Kubernetes Service (CKS) plugin allows a tenant to add and remove nodes
Two-factor authentication bypass in Apache CloudStack allows an authenticated low-privileged user to exploit an improper
Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticat
SAML authentication bypass in Apache CloudStack 4.20.3.0 and 4.22.1.0 permits a network-positioned attacker to forge SAM
Sensitive OAuth configuration data is exposed to unauthenticated remote actors in Apache CloudStack's OAuth authenticati
Sensitive information exposure in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration allows u
Missing authorization controls across multiple Userdata-related APIs in Apache CloudStack expose cross-tenant data to an
Broken object-level authorization in Apache CloudStack exposes project role management APIs to Domain Admins operating o
Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issui
Resource exhaustion in Apache CloudStack's scoped global configuration subsystem-spanning versions 4.7.0 through 4.20.3.
Improper access control in the CloudStack Backup plugin allows authenticated users in CloudStack 4.21.0.0 through 4.22.0
Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any ac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today