CVE-2025-59454

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope. Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/11/27/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack:4.21.0.0:::::::*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En Apache CloudStack, una brecha en las comprobaciones de control de acceso afectó a las APIs: - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory Si bien estas APIs eran accesibles solo para usuarios autorizados, una validación de permisos insuficiente significaba que los usuarios podían ocasionalmente acceder a información más allá de su alcance previsto. Se recomienda a los usuarios actualizar a Apache CloudStack 4.20.2.0 o 4.22.0.0, que corrige el problema.

Information

Published : 2025-11-27 12:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-59454

Mitre link : CVE-2025-59454

CVE.ORG link : CVE-2025-59454

JSON object : View

Products Affected

apache

cloudstack

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-59454", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59454", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-28T15:41:41.950318Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.20.2", "versionType": "semver"}, {"status": "affected", "version": "4.21.0", "lessThan": "4.22.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-27T12:15:47.550", "references": [{"url": "https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/27/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL\n- listNetworkACLs\n- listResourceDetails\n- listVirtualMachinesUsageHistory\n- listVolumesUsageHistory\n\nWhile these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.\n\n\n\n\nUsers are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue."}, {"lang": "es", "value": "En Apache CloudStack, una brecha en las comprobaciones de control de acceso afect\u00f3 a las APIs:\n- createNetworkACL\n- listNetworkACLs\n- listResourceDetails\n- listVirtualMachinesUsageHistory\n- listVolumesUsageHistory\n\nSi bien estas APIs eran accesibles solo para usuarios autorizados, una validaci\u00f3n de permisos insuficiente significaba que los usuarios pod\u00edan ocasionalmente acceder a informaci\u00f3n m\u00e1s all\u00e1 de su alcance previsto.\n\nSe recomienda a los usuarios actualizar a Apache CloudStack 4.20.2.0 o 4.22.0.0, que corrige el problema."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "740D231F-5A6F-44FD-9CC8-246BF3BDA73F", "versionEndExcluding": "4.20.2.0", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cloudstack:4.21.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D19C2F1-2730-4EAE-A7CF-950F185B76FC"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}