In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL
- listNetworkACLs
- listResourceDetails
- listVirtualMachinesUsageHistory
- listVolumesUsageHistory
While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.
Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc | Vendor Advisory Mailing List |
| http://www.openwall.com/lists/oss-security/2025/11/27/3 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Dec 2025, 14:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc - Vendor Advisory, Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2025/11/27/3 - Mailing List, Third Party Advisory | |
| First Time |
Apache cloudstack
Apache |
|
| CPE | cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:* cpe:2.3:a:apache:cloudstack:4.21.0.0:*:*:*:*:*:*:* |
28 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
27 Nov 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 Nov 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-27 12:15
Updated : 2025-12-02 14:38
NVD link : CVE-2025-59454
Mitre link : CVE-2025-59454
CVE.ORG link : CVE-2025-59454
JSON object : View
Products Affected
apache
- cloudstack
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor