CVE-2025-22829

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-22829

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22829.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-22829

Published

2025-06-10T23:15:22.740Z

Modified

2026-04-10T05:22:46.484420Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.

Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.

References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

Last affected

2fe3fcef7c77cf9a1b629c9df3afc0cdb88ad4f6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.20.0.0"
        }
    ]
}

Affected versions

4.*

4.12.0.0

4.16.0.0

4.17.0.0

4.18.0.0

4.20.0.0

Other

acton-beta1-prerelease-1

ovm3

tag-3.*

tag-3.0.1-prerelease-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22829.json"