CVE-2024-29007

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-29007

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29007.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-29007

Published

2024-04-04T08:15:06.970Z

Modified

2026-04-10T05:11:41.987401Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

[none]

Details

The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.

References

https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

af2679959b634d095b93b8265c6da294d360065d

Fixed

b28f3cd788f74575449461af72ee98941cb2ab68

Introduced

Last affected

2746225b999612f156e421199e34ef8de98a3664

Database specific

{
    "versions": [
        {
            "introduced": "4.9.1.0"
        },
        {
            "fixed": "4.18.1.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.19.0.0"
        }
    ]
}

Affected versions

4.*

4.12.0.0

4.16.0.0

4.17.0.0

4.18.0.0

4.18.1.0

4.19.0.0

Other

acton-beta1-prerelease-1

ovm3

tag-3.*

tag-3.0.1-prerelease-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29007.json"