VULNERABILITY INTELLIGENCE

CVE-2025-59302

CVSS score4.7 MEDIUM
EPSS probability0.49%
CISA KEVNot currently listed
Published2025-11-27
Last modified2026-10-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Description

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

Weakness classification

  • security@apache.org: CWE-94
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Primary references