Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Apache CloudStack — lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp Clear all filters
TI-2024-19192 CVE-2024-29008 · GHSA-3fpg-5xv7-pq63

Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance

Priority LOW 29

A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or configure settings of an already deployed VM i…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00619 Published 2024-04-04 No fix listed CWE-20
TI-2024-19191 CVE-2024-29007 · GHSA-29xc-2rhm-5f2q

Server-side request forgery in Apache CloudStack

Priority LOW 39

The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading te…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00785 Published 2024-04-04 No fix listed CWE-918
TI-2024-19190 CVE-2024-29006 · GHSA-w59w-35q3-vcg7

Apache CloudStack: x-forwarded-for HTTP header parsed by default

Priority MEDIUM 44

By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00874 Published 2024-04-04 No fix listed CWE-290