CVE-2024-42062: Apache CloudStack: User Key Exposure to Domain Admins
First published: Tue Aug 06 2024(Updated: )
CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure. Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache CloudStack | >=4.10.0.0<4.18.2.3 | |
| Apache CloudStack | >=4.19.0.0<4.19.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-42062?
CVE-2024-42062 is rated as a high-severity vulnerability affecting Apache CloudStack.
How do I fix CVE-2024-42062?
To mitigate CVE-2024-42062, users should upgrade Apache CloudStack to versions 4.18.2.3 or 4.19.1.1.
Who is affected by CVE-2024-42062?
CVE-2024-42062 affects account-users of Apache CloudStack that utilize username and password authentication.
What types of authentication are involved in CVE-2024-42062?
CVE-2024-42062 involves username and password based authentication and randomized API and secret keys.
What potential risks does CVE-2024-42062 pose?
CVE-2024-42062 may allow unauthorized API access due to insufficient access permission validation.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-42062
- agent/first-publish-date
- agent/references
- agent/author
- agent/type
- agent/description
- agent/title
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/source
- agent/tags
- agent/trending
- vendor/apache
- canonical/apache cloudstack
- version/apache cloudstack/4.10.0.0
- version/apache cloudstack/4.19.0.0