CVE-2024-45693 Information

Description

Users logged into the Apache CloudStack’s web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover disruption exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform.

This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1

Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2 or later which addresses this issue.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8