Orta CVSS 4.7
CVE-2025-59302: Cloudstack: kod enjeksiyonu
Açıklama (NVD)
In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
Özet bilgiler
- Ürün
- Apache Cloudstack
- CVSS v3.1
- 4.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - EPSS
- %0,49 (yüzdelik 42)
- CWE
- CWE-94
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| apache-cloudstack | 4.18.0.0 | — | 4.20.2.0 |
| apache-cloudstack | 4.21.0.0 | 4.21.0.0 | — |