CVE-2024-45462: The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend…

PriorityP430high7.1CVSS 3.1

AVLACLPRNUIRSUCHIHAN

EPSS

0.39%

31.5th percentile

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out user account. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	cloudstack	>= 4.15.1.0 < 4.18.2.4	4.18.2.4
apache	cloudstack	>= 4.19.0.0 < 4.19.1.2	4.19.1.2
apache_software_foundation	apache_cloudstack	4.15.1.0 – 4.18.2.3	—
apache_software_foundation	apache_cloudstack	4.19.0.0 – 4.19.1.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.