CVE-2025-30675

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-30675", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-03-25T07:15:12.974Z", "datePublished": "2025-06-10T23:12:23.838Z", "dateUpdated": "2025-06-11T13:52:21.335Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.19.3.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "4.20.1.0", "status": "affected", "version": "4.20.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bernardo De Marco Gon\u00e7alves <bernardomg2004@gmail.com>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.</span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.&nbsp;</span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">This vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain.</span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\"><br></span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Affected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0.</span></div>"}], "value": "In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.\n\nA malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.\u00a0\n\nThis vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain.\n\n\n\n\nAffected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-06-10T23:12:23.838Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/"}, {"tags": ["third-party-advisory"], "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/"}, {"tags": ["mailing-list"], "url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-11T13:52:11.857369Z", "id": "CVE-2025-30675", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:52:21.335Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-30675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-11T13:52:11.857369Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:52:17.322Z"}}], "cna": {"title": "Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Bernardo De Marco Gon\u00e7alves <bernardomg2004@gmail.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.19.3.0", "versionType": "semver"}, {"status": "affected", "version": "4.20.0.0", "lessThan": "4.20.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/", "tags": ["vendor-advisory"]}, {"url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/", "tags": ["third-party-advisory"]}, {"url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60", "tags": ["mailing-list"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.\n\nA malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.\u00a0\n\nThis vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain.\n\n\n\n\nAffected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0.", "supportingMedia": [{"type": "text/html", "value": "<div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.</span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">A malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.&nbsp;</span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">This vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain.</span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\"><br></span></div><div><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Affected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0.</span></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-06-10T23:12:23.838Z"}}}, "cveMetadata": {"cveId": "CVE-2025-30675", "state": "PUBLISHED", "dateUpdated": "2025-06-11T13:52:21.335Z", "dateReserved": "2025-03-25T07:15:12.974Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-06-10T23:12:23.838Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.19.3.0", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "4.20.1.0", "status": "affected", "version": "4.20.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E2CBB12-83B5-41E9-9C38-5C36008CC567", "versionEndExcluding": "4.19.3.0", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "67E1FECD-94E6-4B2A-A52D-47D7FC8C9B10", "versionEndExcluding": "4.20.1.0", "versionStartIncluding": "4.20.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized visibility into templates and ISOs under the ROOT domain.\n\nA malicious admin can enumerate and extract metadata of templates and ISOs that belong to unrelated domains, violating isolation boundaries and potentially exposing sensitive or internal configuration details.\u00a0\n\nThis vulnerability has been fixed by ensuring the domain resolution strictly adheres to the caller's scope rather than defaulting to the ROOT domain.\n\n\n\n\nAffected users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0."}, {"lang": "es", "value": "En Apache CloudStack, una falla en el control de acceso afecta a las API listTemplates y listIsos. Un administrador de dominio o de recursos malintencionado puede explotar este problema especificando intencionadamente el par\u00e1metro \"domainid\" junto con los valores \"filter=self\" o \"filter=selfexecutable\". Esto permite al atacante obtener acceso no autorizado a plantillas e ISOs del dominio ROOT. Un administrador malintencionado puede enumerar y extraer metadatos de plantillas e ISOs pertenecientes a dominios no relacionados, violando los l\u00edmites de aislamiento y exponiendo potencialmente detalles confidenciales o de configuraci\u00f3n interna. Esta vulnerabilidad se ha corregido garantizando que la resoluci\u00f3n del dominio se ajuste estrictamente al alcance del llamante, en lugar de usar el dominio ROOT por defecto. Se recomienda a los usuarios afectados actualizar a Apache CloudStack 4.19.3.0 o 4.20.1.0."}], "id": "CVE-2025-30675", "lastModified": "2026-06-17T09:09:09.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30675", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-11T13:52:11.857369Z", "version": "2.0.3"}}]}, "published": "2025-06-11T00:15:24.730", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60"}, {"source": "security@apache.org", "tags": ["Broken Link"], "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"created": "2025-06-24T09:44:14.293893+00:00", "updated": "2025-06-24T09:44:14.293959+00:00", "vendors": ["apache", "apache$PRODUCT$cloudstack"]}