CVE-2025-47849

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-47849", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-05-12T08:45:45.595Z", "datePublished": "2025-06-10T23:07:54.526Z", "dateUpdated": "2026-02-26T17:50:43.214Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.19.3.0", "status": "affected", "version": "4.10.0", "versionType": "semver"}, {"lessThan": "4.20.1.0", "status": "affected", "version": "4.20.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kevin Li <kli74@apple.com>"}, {"lang": "en", "type": "finder", "value": "Scott Schmitz <sschmitz@ussignal.com>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><span style=\"background-color: rgba(232, 232, 232, 0.04);\"><span style=\"background-color: rgba(232, 232, 232, 0.04);\">A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. </span><span style=\"background-color: rgba(232, 232, 232, 0.04);\">A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that <span style=\"background-color: rgb(255, 255, 255);\">could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.</span><br></span><br><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:<br></span></span></div><div><ul><li><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Strict validation on Role Type hierarchy: the caller's role must be equal to or higher than the target user's role.&nbsp;</span></li><li><span style=\"background-color: rgba(232, 232, 232, 0.04);\">API privilege comparison: the caller must possess all privileges of the user they are operating on.&nbsp;</span></li><li><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Two new domain-level settings (restricted to the default admin):&nbsp;<br>\u2003- role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: \"Admin, DomainAdmin, ResourceAdmin\".&nbsp;<br>\u2003- allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true.</span></li></ul></div>"}], "value": "A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.\n\nUsers are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:\n\n\n * Strict validation on Role Type hierarchy: the caller's role must be equal to or higher than the target user's role.\u00a0\n * API privilege comparison: the caller must possess all privileges of the user they are operating on.\u00a0\n * Two new domain-level settings (restricted to the default admin):\u00a0\n\u2003- role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: \"Admin, DomainAdmin, ResourceAdmin\".\u00a0\n\u2003- allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-06-10T23:07:54.526Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/"}, {"tags": ["third-party-advisory"], "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/"}, {"tags": ["mailing-list"], "url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-47849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-14T03:56:16.606155Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:50:43.214Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-47849", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-11T13:44:38.350448Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:45:07.392Z"}}], "cna": {"title": "Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Kevin Li <kli74@apple.com>"}, {"lang": "en", "type": "finder", "value": "Scott Schmitz <sschmitz@ussignal.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache CloudStack", "versions": [{"status": "affected", "version": "4.10.0", "lessThan": "4.19.3.0", "versionType": "semver"}, {"status": "affected", "version": "4.20.0.0", "lessThan": "4.20.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/", "tags": ["vendor-advisory"]}, {"url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/", "tags": ["third-party-advisory"]}, {"url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60", "tags": ["mailing-list"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.\n\nUsers are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:\n\n\n * Strict validation on Role Type hierarchy: the caller's role must be equal to or higher than the target user's role.\u00a0\n * API privilege comparison: the caller must possess all privileges of the user they are operating on.\u00a0\n * Two new domain-level settings (restricted to the default admin):\u00a0\n\u2003- role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: \"Admin, DomainAdmin, ResourceAdmin\".\u00a0\n\u2003- allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true.", "supportingMedia": [{"type": "text/html", "value": "<div><span style=\"background-color: rgba(232, 232, 232, 0.04);\"><span style=\"background-color: rgba(232, 232, 232, 0.04);\">A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. </span><span style=\"background-color: rgba(232, 232, 232, 0.04);\">A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that <span style=\"background-color: rgb(255, 255, 255);\">could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.</span><br></span><br><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:<br></span></span></div><div><ul><li><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Strict validation on Role Type hierarchy: the caller's role must be equal to or higher than the target user's role.&nbsp;</span></li><li><span style=\"background-color: rgba(232, 232, 232, 0.04);\">API privilege comparison: the caller must possess all privileges of the user they are operating on.&nbsp;</span></li><li><span style=\"background-color: rgba(232, 232, 232, 0.04);\">Two new domain-level settings (restricted to the default admin):&nbsp;<br>\u2003- role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: \"Admin, DomainAdmin, ResourceAdmin\".&nbsp;<br>\u2003- allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true.</span></li></ul></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-06-10T23:07:54.526Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47849", "state": "PUBLISHED", "dateUpdated": "2025-06-14T03:56:15.872Z", "dateReserved": "2025-05-12T08:45:45.595Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-06-10T23:07:54.526Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache CloudStack", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.19.3.0", "status": "affected", "version": "4.10.0", "versionType": "semver"}, {"lessThan": "4.20.1.0", "status": "affected", "version": "4.20.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "F76F9027-3B50-4AEA-8E3D-E0C8A4E256A8", "versionEndExcluding": "4.19.3.0", "versionStartIncluding": "4.10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*", "matchCriteriaId": "67E1FECD-94E6-4B2A-A52D-47D7FC8C9B10", "versionEndExcluding": "4.20.1.0", "versionStartIncluding": "4.20.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.\n\nUsers are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:\n\n\n * Strict validation on Role Type hierarchy: the caller's role must be equal to or higher than the target user's role.\u00a0\n * API privilege comparison: the caller must possess all privileges of the user they are operating on.\u00a0\n * Two new domain-level settings (restricted to the default admin):\u00a0\n\u2003- role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: \"Admin, DomainAdmin, ResourceAdmin\".\u00a0\n\u2003- allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true."}, {"lang": "es", "value": "Existe una vulnerabilidad de escalada de privilegios en Apache CloudStack, versiones 4.10.0.0 a 4.20.0.0, donde un usuario administrador de dominio malintencionado en el dominio ROOT puede obtener la clave API y la clave secreta de las cuentas de usuario con el rol de administrador en el mismo dominio. Esta operaci\u00f3n no est\u00e1 restringida adecuadamente y permite al atacante asumir el control sobre cuentas de usuario con mayores privilegios. Un atacante malintencionado de dominio puede suplantar una cuenta de usuario administrador y obtener acceso a API y recursos confidenciales que podr\u00edan comprometer la integridad y confidencialidad de los recursos, la p\u00e9rdida de datos, la denegaci\u00f3n de servicio y la disponibilidad de la infraestructura administrada por CloudStack. Se recomienda a los usuarios actualizar a Apache CloudStack 4.19.3.0 o 4.20.1.0, que soluciona el problema con lo siguiente: * Validaci\u00f3n estricta en la jerarqu\u00eda de tipos de rol: el rol del llamante debe ser igual o superior al rol del usuario objetivo. * Comparaci\u00f3n de privilegios de API: el usuario que realiza la llamada debe tener todos los privilegios del usuario con el que opera. * Dos nuevas configuraciones a nivel de dominio (restringidas al administrador predeterminado): - role.types.allowed.for.operations.on.accounts.of.same.role.type: Define qu\u00e9 tipos de rol pueden actuar sobre usuarios del mismo tipo. Predeterminado: \"Admin, DomainAdmin, ResourceAdmin\". - allow.operations.on.users.in.same.account: Permite o impide las operaciones de usuario dentro de la misma cuenta. Predeterminado: true."}], "id": "CVE-2025-47849", "lastModified": "2026-06-17T09:28:45.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-47849", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-06-14T03:56:16.606155Z", "version": "2.0.3"}}]}, "published": "2025-06-10T23:15:58.453", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60"}, {"source": "security@apache.org", "tags": ["Broken Link"], "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"created": "2025-06-23T09:16:30.670282+00:00", "updated": "2025-06-23T09:16:30.670330+00:00", "vendors": ["apache", "apache$PRODUCT$apache_cloudstack"]}