CVE-2025-59302

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-59302

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59302.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-59302

Published

2025-11-27T12:15:47.410Z

Modified

2026-04-10T05:31:57.735428Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

[none]

Details

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

quotaTariffCreate
quotaTariffUpdate
createSecondaryStorageSelector
updateSecondaryStorageSelector
updateHost
updateStorage

This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

References

Affected packages

Git / github.com/apache/cloudstack

Affected ranges

Type

GIT

Repo

https://github.com/apache/cloudstack

Events

Introduced

0574087284f8b646ebc41617cfd70b3a31e3ae94

Fixed

4dc3931233bafb748d5fe2c7e0f6f3499d76bc3a

Introduced

Last affected

f9513b47bf8cda46c2cee7e31d4d662346bc7399

Database specific

{
    "versions": [
        {
            "introduced": "4.18.0.0"
        },
        {
            "fixed": "4.20.2.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.21.0.0"
        }
    ]
}

Affected versions

4.*

4.18.0.0

4.20.0.0

4.20.1.0

4.21.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59302.json"