Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2024-42062

7.2 · HIGH

CloudStack account-users by default use username and password based authentication for API and UI access.

Published Aug 7, 2024CWE-863EPSS 0.95%

Overview

CVE-2024-42062 is a high-severity vulnerability. It was published on August 7, 2024 and has a CVSS 3.1 base score of 7.2 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.2, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical description

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that affects Apache CloudStack versions 4.10.0 up to 4.19.1.0, domain admin accounts were found to be able to query all registered account-users API and secret keys in an environment, including that of a root admin. An attacker who has domain admin access can exploit this to gain root admin and other-account privileges and perform malicious operations that can result in compromise of resources integrity and confidentiality, data loss, denial of service and availability of CloudStack managed infrastructure.

Users are recommended to upgrade to Apache CloudStack 4.18.2.3 or 4.19.1.1, or later, which addresses this issue. Additionally, all account-user API and secret keys should be regenerated.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refcloudstack.apache.org/blog/security-release-advisory-4.19.1.1-4.18.2.3Reflists.apache.org/thread/lxqtfd6407prbw3801hb4fz3ot3t8wljRefwww.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-3-and-4-19-1-1/Refwww.openwall.com/lists/oss-security/2024/08/06/5

How CyberStrike helps

Frequently asked questions

What is CVE-2024-42062?

CVE-2024-42062 is a high-severity vulnerability. It was published on August 7, 2024 and has a CVSS 3.1 base score of 7.2 (HIGH).

How severe is CVE-2024-42062?

This vulnerability has a CVSS 3.1 base score of 7.2, rated HIGH. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-42062?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-42062?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-42062 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2024

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999