CVE-2024-42222

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42222
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42222.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-42222
Published
2024-08-07T07:16:13Z
Modified
2026-08-12T03:51:24Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Apache CloudStack: Unauthorised Network List Access
Details

In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user accounts. This vulnerability compromises tenant isolation, potentially leading to unauthorised access to network details, configurations and data.

Affected users are advised to upgrade to version 4.19.1.1 to address this issue. Users on older versions of CloudStack considering to upgrade, can skip 4.19.1.0 and upgrade directly to 4.19.1.1.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42222.json"
}
References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type
GIT
Repo
https://github.com/apache/cloudstack
Events
Introduced
9f4c8959743d2f53faae6fc5d68e88ddc20e21a3
Last Affected
9f4c8959743d2f53faae6fc5d68e88ddc20e21a3
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:cloudstack:4.19.1.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.19.1.0"
        },
        {
            "last_affected": "4.19.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

4.*
4.19.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42222.json"