SB2024111508 - Remote code execution in Apache CloudStack
Published: November 15, 2024
Security Bulletin ID
SB2024111508
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper privilege management (CVE-ID: CVE-2024-50386)
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due the application allows users to register templates to be downloaded directly to the primary storage for deploying instances however does not perform validation checks for KVM-compatible templates. A remote user who can register such templates can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems.
Remediation
Install update from vendor's website.