CVE-2024-29007

Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences

State: Published
Severity: 7.3 High
Published: Apr 4, 2024
Updated: Nov 12, 2024
Reserved: Mar 13, 2024

Read the record on cve.org

Description

The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	CISA-ADP

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Apache CloudStackApache Software Foundation	4.9.1.0 through 4.18.1.0Affected 4.19.0.0Affected

References

https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvpvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.