CVE-2024-45461: The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In…

PriorityP339medium6.3CVSS 3.1

AVNACLPRLUINSUCLILAL

EPSS

0.71%

49.2th percentile

The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false".

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	cloudstack	>= 4.19.0.0 < 4.19.1.2	4.19.1.2
apache	cloudstack	>= 4.7.0 < 4.18.2.4	4.18.2.4
apache_software_foundation	apache_cloudstack_quota_plugin	4.19.0.0 – 4.19.1.1	—
apache_software_foundation	apache_cloudstack_quota_plugin	4.7.0 – 4.18.2.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.