Vulnerabilities

TI-2024-25607 CVE-2024-38346 · GHSA-7g4v-8cvx-gp5q

Apache CloudStack: Unauthenticated cluster service port leads to remote execution

MEDIUM 55

The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03301 Published 2024-07-05 No fix listed CWE-94

TI-2024-26763 CVE-2024-39864 · GHSA-qcg7-r5qq-mqmw

Apache CloudStack: Integration API service uses dynamic port when disabled

MEDIUM 52

The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port global setting) for internal portal integrations and for tes…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01772 Published 2024-07-05 No fix listed CWE-665

Vulnerabilities

Filters

Apache CloudStack: Unauthenticated cluster service port leads to remote execution

Apache CloudStack: Integration API service uses dynamic port when disabled