CVE-2024-29007

7.3 highEPSS 0.8%

High (7.3) in apache cloudstack. EPSS 0.8% chance of exploitation in the next 30 days.

The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.

Severity

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2024-04-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:cloudstack

References

https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp
https://lists.apache.org/thread/82f46pv7mvh95ybto5hn8wlo6g8jhjvp

Check your stack JSON