Vulnerability · Published Jun 10, 2025 · Assigned by apache
CVE-2025-22829Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
Low 2.3
In plain English
A low-severity privilege mismanagement in Apache CloudStack from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations. Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.20.0.0 – before 4.20.1.0 |
Weakness: CWE-269 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber
References
- https://cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0 vendor-advisory
- https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/ third-party-advisory
- https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60 mailing-list