CVE-2025-59454CWE-200information-disclosure

CVE-2025-59454

Medium · published November 27, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
28.8
In the wild
Unconfirmed
What it is

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL

- listNetworkACLs

- listResourceDetails

- listVirtualMachinesUsageHistory

- listVolumesUsageHistory

While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.

Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-11-27T17:15Z
Affected products (2)
ProductVersionsFixed in
apache/cloudstack≥ 4.0.0, < 4.20.2.04.20.2.0
apache/cloudstackall versions—
References (2)
https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc · [email protected]http://www.openwall.com/lists/oss-security/2025/11/27/3 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 27 NOV 11:40Z
    Apache CloudStack: Lack of user permission validation leading to data leak for few APIs
    cvelistv5