[<prev] [next>] [day] [month] [year] [list]
Message-ID: <09607e98-888f-db6b-9891-5d82be4932eb@apache.org>
Date: Thu, 27 Nov 2025 06:35:16 +0000
From: Harikrishna Patnala <harikrishna@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-59302: Apache CloudStack: Potential remote code execution
on Javascript engine defined rules
Severity: low
Affected versions:
- Apache CloudStack 4.18.0 before 4.20.2
- Apache CloudStack 4.21.0 before 4.22.0
Description:
In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.
* quotaTariffCreate
* quotaTariffUpdate
* createSecondaryStorageSelector
* updateSecondaryStorageSelector
* updateHost
* updateStorage
This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.
The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
Credit:
Tianyi Cheng <chengtianyi@...wei.com> (finder)
References:
https://cloudstack.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-59302
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
