CVE-2025-59302
INFO
Priority: 0.00
BB Relevance:
0/100
Published: 2025-11-27
Modified: 2026-11-03
First seen: 2026-11-03
Status: pending_score
Description
In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache CloudStack | 4.18.0 < 4.20.2 |
| Apache Software Foundation | Apache CloudStack | 4.21.0 < 4.22.0 |
References & Advisories (1)
vendor-advisory