CVE-2025-59454
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
27/11/2025
Last modified:
02/12/2025
Description
In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL<br />
- listNetworkACLs<br />
- listResourceDetails<br />
- listVirtualMachinesUsageHistory<br />
- listVolumesUsageHistory<br />
<br />
While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.<br />
<br />
<br />
<br />
<br />
Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.
Impact
Base Score 3.x
4.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:* | 4.0.0 (including) | 4.20.2.0 (excluding) |
| cpe:2.3:a:apache:cloudstack:4.21.0.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page