Vulnerability Details CVE-2024-29007
The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 25.3%
CVSS Severity
CVSS v3 Score 7.3
References
Products affected by CVE-2024-29007
-
cpe:2.3:a:apache:cloudstack:4.10.0.0
-
cpe:2.3:a:apache:cloudstack:4.11.0.0
-
cpe:2.3:a:apache:cloudstack:4.11.1
-
cpe:2.3:a:apache:cloudstack:4.11.1.0
-
cpe:2.3:a:apache:cloudstack:4.11.2.0
-
cpe:2.3:a:apache:cloudstack:4.11.3.0
-
cpe:2.3:a:apache:cloudstack:4.12.0.0
-
cpe:2.3:a:apache:cloudstack:4.13.0.0
-
cpe:2.3:a:apache:cloudstack:4.13.1.0
-
cpe:2.3:a:apache:cloudstack:4.14.0.0
-
cpe:2.3:a:apache:cloudstack:4.14.1.0
-
cpe:2.3:a:apache:cloudstack:4.15.0.0
-
cpe:2.3:a:apache:cloudstack:4.15.1.0
-
cpe:2.3:a:apache:cloudstack:4.15.2.0
-
cpe:2.3:a:apache:cloudstack:4.16.0.0
-
cpe:2.3:a:apache:cloudstack:4.16.1.0
-
cpe:2.3:a:apache:cloudstack:4.16.1.1
-
cpe:2.3:a:apache:cloudstack:4.17.0.0
-
cpe:2.3:a:apache:cloudstack:4.17.0.1
-
cpe:2.3:a:apache:cloudstack:4.17.2.0
-
cpe:2.3:a:apache:cloudstack:4.18.0.0
-
cpe:2.3:a:apache:cloudstack:4.18.1.0
-
cpe:2.3:a:apache:cloudstack:4.19.0.0
-
cpe:2.3:a:apache:cloudstack:4.9.1.0
-
cpe:2.3:a:apache:cloudstack:4.9.2.0
-
cpe:2.3:a:apache:cloudstack:4.9.3.0
-
cpe:2.3:a:apache:cloudstack:4.9.3.1