CVE-2024-45693

HIGH EPSS 38.8%
Published Oct 16, 20241y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Oct 16, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
38.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 2

VendorProductVersionRange
apachecloudstack*≥4.15.1.0  –  <4.18.2.4
apachecloudstack*≥4.19.0.0  –  <4.19.1.2

References 3

  • openwall.com http://www.openwall.com/lists/oss-security/2024/10/15/5
  • cloudstack.apache.org https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2
    Vendor Advisory
  • lists.apache.org https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.