CVE-2025-22829CWE-269

Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin

Low · published June 10, 2025

CVSS v4.0
2.3
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.

Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber
EPSS
0.00821 · 56.8th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-06-10T23:11Z
EPSS history
Timeline
  • 10 JUN 23:11Z
    Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
    cvelistv5