Apache Cloudstack any version

Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.

Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure

Apache CloudStack SAML Single Sign-On XXE

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources.

Apache CloudStack: Unauthenticated cluster service port leads to remote execution

A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability is due to the lack of validation of the mac parameter in baremetal virtual router. If you insert an arbitrary shell command into the mac parameter, v-router will process the command. For example: Normal: http://{GW}:10086/baremetal/provisiondone/{mac}, Abnormal: http://{GW}:10086/baremetal/provisiondone/#';whoami;#. Mitigation of this issue is an upgrade to Apache CloudStack 4.13.1.0 or beyond.

Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.

Apache CloudStack: Integration API service uses dynamic port when disabled

Apache CloudStack: x-forwarded-for HTTP header parsed by default

Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI

Apache CloudStack: Improper access control in Kubernetes Service (CKS) cluster manipulation

Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance Access

Apache CloudStack: Get and Run Diagnostics Command Injection

Apache CloudStack: OS Command Injection due to unsanitized mount command

Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates

Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates

Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow

Apache CloudStack: Domain Admin can reset Admin password in Root Domain

Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain

Apache CloudStack: Request origin validation bypass makes account takeover possible

Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure

Apache CloudStack: SAML Signature Exclusion

Apache CloudStack: CKS cluster in project exposes user API keys

Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access to

Apache CloudStack: MinIO policy remains intact on bucket deletion

Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP

Apache Cloudstack insecure random number generation affects project email invitation

Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

Apache CloudStack: LDAP provider configuration disclosure

Apache CloudStack: OAuth2 Token Cross-Request Leak

Apache CloudStack: DoS caused by database connections leak

Apache CloudStack: Improper access control in Userdata reference APIs

Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob

Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences

Apache CloudStack: User Key Exposure to Domain Admins

Apache CloudStack: ProjectRole & ProjectRolePermission authorization issue

Apache CloudStack: Incomplete session invalidation on web interface logout

Apache CloudStack: Any user can create a new VM from backups they should not have access to

Apache CloudStack: Any user can list backups that they should not have access to