TI-2024-14300 Aliases CVE-2024-21545

Proxmox Virtual Environment is an open-source server management platform for enterprise…

LOW 38CWE-73Published 2024-09-24 · Updated 2024-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrary host files via the API. When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user. Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read. The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00363 30th percentileScored 2026-11-07

Fix Fixed pve-manager (Proxmox): 7.4-19, 8.2.7libpve-storage-perl (Proxmox): 7.4-4, 8.2.5+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Proxmox	pve-manager	before 7.4-19; 8.0.0 to before 8.2.7	7.4-19, 8.2.7	Patch available	CNA
Proxmox	libpve-storage-perl	before 7.4-4; 8.0.0 to before 8.2.5	7.4-4, 8.2.5	Patch available	CNA
Proxmox	libpve-http-server-perl	3.2-1 to before 4.3.0; 5.0.0 to before 5.1.1	4.3.0, 5.1.1	Patch available	CNA
Proxmox	pmg-api	before 7.3-12; 8.0.0 to before 8.1.4	7.3-12, 8.1.4	Patch available	CNA
Proxmox	libpve-common-perl (Promox VE 8)	before 8.2.3	8.2.3	Patch available	CNA
Proxmox	libpve-common-perl (Promox Mail Gateway 8)	before 8.2.5	8.2.5	Patch available	CNA

pve-manager VendorProxmox Affected before 7.4-19; 8.0.0 to before 8.2.7 Fixed in 7.4-19, 8.2.7 Patch available CNA
libpve-storage-perl VendorProxmox Affected before 7.4-4; 8.0.0 to before 8.2.5 Fixed in 7.4-4, 8.2.5 Patch available CNA
libpve-http-server-perl VendorProxmox Affected 3.2-1 to before 4.3.0; 5.0.0 to before 5.1.1 Fixed in 4.3.0, 5.1.1 Patch available CNA
pmg-api VendorProxmox Affected before 7.3-12; 8.0.0 to before 8.1.4 Fixed in 7.3-12, 8.1.4 Patch available CNA
libpve-common-perl (Promox VE 8) VendorProxmox Affected before 8.2.3 Fixed in 8.2.3 Patch available CNA
libpve-common-perl (Promox Mail Gateway 8) VendorProxmox Affected before 8.2.5 Fixed in 8.2.5 Patch available CNA

CPE names CISA-ADP · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:proxmox:mail_gateway::::::::	—	—	Proxmox
cpe:2.3:a:proxmox:virtual_environment::::::::	—	—	Proxmox

cpe:2.3:a:proxmox:mail_gateway:*:*:*:*:*:*:*:* Versions — — ·Proxmox
cpe:2.3:a:proxmox:virtual_environment:*:*:*:*:*:*:*:* Versions — — ·Proxmox

Remediation

Fix · CNA pve-manager (Proxmox) Fixed in 7.4-19, 8.2.7
Fix · CNA libpve-storage-perl (Proxmox) Fixed in 7.4-4, 8.2.5
Fix · CNA libpve-http-server-perl (Proxmox) Fixed in 4.3.0, 5.1.1
Fix · CNA pmg-api (Proxmox) Fixed in 7.3-12, 8.1.4
Fix · CNA libpve-common-perl (Promox VE 8) (Proxmox) Fixed in 8.2.3
Fix · CNA libpve-common-perl (Promox Mail Gateway 8) (Proxmox) Fixed in 8.2.5

Timeline

2026-10-02 Threatist record created from CVE-2024-21545

References

Other 2

TI-2022-16050 Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF… CVSS 3.1CRITICAL 9.8
TI-2022-13353 A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior… CVSS 3.1CRITICAL 9.0
TI-2022-16049 A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE)… CVSS 3.1HIGH 7.1
TI-2025-35562 A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party… CVSS 3.1MEDIUM 5.4
TI-2025-35561 A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the… CVSS 3.1MEDIUM 5.4
TI-2025-35560 A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the… CVSS 3.1MEDIUM 5.4

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences