Vulnerability Description
In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope. Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Cloudstack | >= 4.0.0, < 4.20.2.0 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbcMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2025/11/27/3Mailing ListThird Party Advisory
FAQ
What is CVE-2025-59454?
CVE-2025-59454 is a vulnerability with a CVSS score of 4.3 (MEDIUM). In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While the...
How severe is CVE-2025-59454?
CVE-2025-59454 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-59454?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Cloudstack.