CVE-2024-29007

HIGH

Apache CloudStack 4.9.1.0-4.18.1.0 - Server-Side Request Forgery via HTTP Redirect Handling

Title source: llm
STIX 2.1

Description

The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.

References (1)

Core 1
Core References
Mailing List, Vendor Advisory vendor-advisory
https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp

Scores

CVSS v3 7.3
EPSS 0.0014
EPSS Percentile 32.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (2)
apache/cloudstack 4.19.0.0
apache/cloudstack 4.9.1.0 - 4.18.1.1
Published Apr 04, 2024
Tracked Since Feb 18, 2026