CVE-2025-59302

MEDIUM

Apache CloudStack 4.18.0-4.20.1 and 4.21.0-4.21.9 - Authenticated Code Injection via Admin APIs

Title source: llm

Description

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

References (2)

Core 2

Core References

Mailing List, Vendor Advisory vendor-advisory

https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2025/11/27/2

Scores

CVSS v3 4.7

EPSS 0.0008

EPSS Percentile 23.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

apache/cloudstack 4.21.0.0

apache/cloudstack 4.18.0.0 - 4.20.2.0

Published Nov 27, 2025

Tracked Since Feb 18, 2026