The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp | Mailing List Vendor Advisory |
| https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp | Mailing List Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Jun 2025, 15:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:* cpe:2.3:a:apache:cloudstack:4.19.0.0:*:*:*:*:*:*:* |
|
| References | () https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp - Mailing List, Vendor Advisory | |
| First Time |
Apache cloudstack
Apache |
|
| CWE | CWE-59 |
04 Apr 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-04-04 08:15
Updated : 2025-06-30 15:05
NVD link : CVE-2024-29007
Mitre link : CVE-2024-29007
JSON object : View
Products Affected
apache
- cloudstack
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')