CVE-2024-45693 Apache CloudStack: Request origin validation bypass makes account takeover possible

High 8.0 Published 16 Oct 2024 Updated 16 Oct 2024

Attackers can trick authenticated users into submitting malicious requests, leading to account takeover and resource compromise in Apache CloudStack.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-45693?

CVE-2024-45693 is a high-severity vulnerability in Apache Cloudstack, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform.

This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1

Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.

Weakness: CWE-352

Which versions are affected by CVE-2024-45693?

It affects 1 product.

Products include Apache Cloudstack.

How do I fix CVE-2024-45693?

No fix has been published for CVE-2024-45693 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-45693 being exploited?

There is no known exploitation of CVE-2024-45693 in the wild and no public exploit code.

All Apache Cloudstack vulnerabilities

Sources

Also known as GHSA-gvwv-wfjf-rvm7.