Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-59302

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

Published

2025-11-27T12:15:47.410

Last Modified

2025-12-02T14:36:02.567

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.7 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-94
  • Type: Secondary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache cloudstack < 4.20.2.0 Yes
Application apache cloudstack 4.21.0.0 Yes
References