CVE-2024-50386
Severity
9.9CRITICAL
EPSS
0.9%
top 24.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 12
Description
Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource in…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0
Affected Packages2 packages
🔴Vulnerability Details
2GHSA▶
GHSA-5pg9-rxpc-jxgf: Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instanc↗2024-11-12
CVEList▶
Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure↗2024-11-12
📋Vendor Advisories
1Oracle▶
Oracle Oracle Construction and Engineering Risk Matrix: Document Management (Apache Solr) — CVE-2023-50386↗2024-04-15