// For flags

CVE-2024-45461

Apache CloudStack Quota plugin: Access checks not enforced in Quota

Severity Score

5.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled.




Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false".

La función Cuota de CloudStack permite a los administradores de la nube implementar un sistema de cuota o límite de uso para los recursos de la nube y está deshabilitada de forma predeterminada. En los entornos donde la función está habilitada, debido a la falta de cumplimiento de las comprobaciones de acceso, las cuentas de usuario no administrativas de CloudStack pueden acceder y modificar las configuraciones y los datos relacionados con la cuota. Este problema afecta a Apache CloudStack desde la versión 4.7.0 hasta la 4.18.2.3 y desde la versión 4.19.0.0 hasta la 4.19.1.1, donde la función Cuota está habilitada. Se recomienda a los usuarios que actualicen a Apache CloudStack 4.18.2.4 o 4.19.1.2, o posterior, que soluciona este problema. Como alternativa, se recomienda a los usuarios que no usan la función Cuota que deshabiliten el complemento configurando la configuración global "quota.enable.service" en "false".

*Credits: Fabrício Duarte <fabricio.duarte.jr@gmail.com>
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-08-29 CVE Reserved
  • 2024-10-16 CVE Published
  • 2024-10-16 CVE Updated
  • 2024-11-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache Software Foundation
Search vendor "Apache Software Foundation"
 Apache CloudStack Quota Plugin
Search vendor "Apache Software Foundation" for product "Apache CloudStack Quota Plugin"
 >= 4.7.0.0 <= 4.18.2.3
Search vendor "Apache Software Foundation" for product "Apache CloudStack Quota Plugin" and version " >= 4.7.0.0 <= 4.18.2.3"
en
Affected
Apache Software Foundation
Search vendor "Apache Software Foundation"
 Apache CloudStack Quota Plugin
Search vendor "Apache Software Foundation" for product "Apache CloudStack Quota Plugin"
 >= 4.19.0.0 <= 4.19.1.1
Search vendor "Apache Software Foundation" for product "Apache CloudStack Quota Plugin" and version " >= 4.19.0.0 <= 4.19.1.1"
en
Affected