Plattform
apache
Komponente
quota-plugin
Behoben in
4.20.1.0
CVE-2025-22829 describes a privilege escalation vulnerability within the CloudStack Quota plugin. This flaw allows authenticated users with sufficient API access to manipulate quota-related email settings and configurations for any account within the CloudStack environment, bypassing intended access controls. The vulnerability impacts CloudStack versions 4.20.0.0 through 4.20.1.0. A fix is available in version 4.20.1.0.
An attacker exploiting this vulnerability could gain unauthorized control over quota email notifications and configurations for any account within the CloudStack environment. This could lead to denial of service by disabling critical email alerts, or potentially be used to mask malicious activity by suppressing notifications about quota usage. While direct data exfiltration isn't immediately apparent, the ability to manipulate account configurations could be a stepping stone for further attacks, especially in environments with weak access controls. The blast radius extends to all accounts managed by the vulnerable CloudStack instance.
This vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not yet available, suggesting a low to medium probability of immediate exploitation. The vulnerability was publicly disclosed on 2025-06-10. Active campaigns targeting this specific vulnerability are not currently known.
Organizations utilizing CloudStack with the Quota plugin enabled, particularly those running versions 4.20.0.0 through 4.20.1.0, are at risk. Environments with overly permissive API access controls or shared hosting configurations where multiple users have access to the CloudStack management interface are especially vulnerable.
• apache / server:
# Check for unusual quota configuration changes in CloudStack audit logs
journalctl -u cloudstack -g 'quota' | grep -i 'modified'• generic web:
# Check for unexpected API calls related to quota management
curl -s 'https://<cloudstack_url>/api/cloudstack/quota' | grep -i 'enabled'disclosure
Exploit-Status
EPSS
0.19% (41% Perzentil)
CISA SSVC
The primary mitigation is to upgrade CloudStack to version 4.20.1.0 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider restricting API access for users who do not require quota management capabilities. Implement strict role-based access controls (RBAC) to limit the scope of user privileges. Monitor CloudStack audit logs for any unusual activity related to quota configuration changes. There are no specific WAF rules or detection signatures readily available for this particular vulnerability, making timely patching the most critical step.
Actualice Apache CloudStack a la versión 4.20.1.0 o superior. Esta versión corrige la lógica de gestión de privilegios incorrecta en el plugin Quota. La actualización evitará el acceso no autorizado a recursos dedicados y la manipulación de configuraciones de correo electrónico relacionadas con las cuotas.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2025-22829 is a vulnerability in the CloudStack Quota plugin allowing authenticated users to manipulate quota email settings for any account, bypassing access controls.
You are affected if you are using CloudStack versions 4.20.0.0 through 4.20.1.0 with the Quota plugin enabled.
Upgrade CloudStack to version 4.20.1.0 or later to resolve the vulnerability. Restrict API access as an interim measure.
Active exploitation campaigns targeting CVE-2025-22829 are not currently known, but vigilance is advised.
Refer to the official CloudStack security advisory for details and further guidance.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.