Vulnerabilities

TI-2025-36876 CVE-2025-59302 · GHSA-hgmv-qpw9-xrfq

Apache CloudStack: Potential remote code execution on Javascript engine defined rules

LOW 24

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.0049 Published 2025-11-27 Fixed in 4.20.2, 4.22.0 CWE-94

TI-2025-36999 CVE-2025-59454 · GHSA-g2p7-38hq-rvj6

Apache CloudStack: Lack of user permission validation leading to data leak for few APIs

LOW 20

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessib…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00387 Published 2025-11-27 Fixed in 4.20.2, 4.22.0 CWE-200

Vulnerabilities

Filters

Apache CloudStack: Potential remote code execution on Javascript engine defined rules

Apache CloudStack: Lack of user permission validation leading to data leak for few APIs