Unrated severityNVD Advisory· Published Jun 10, 2025· Updated Jun 11, 2025
Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
CVE-2025-22829
Description
The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations.
Quota plugin users using CloudStack 4.20.0.0 are recommended to upgrade to CloudStack version 4.20.1.0, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2= 4.20.0.0+ 1 more
- (no CPE)range: = 4.20.0.0
- (no CPE)range: 4.20.0.0
Patches
Vulnerability mechanics
References
3- cloudstack.staged.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0mitrevendor-advisory
- www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/mitrethird-party-advisory
- lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60mitremailing-list
News mentions
0No linked articles in our index yet.