Vulnerability Database

315,293

Total vulnerabilities in the database

CVE-2025-59302

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

  • quotaTariffCreate
  • quotaTariffUpdate
  • createSecondaryStorageSelector
  • updateSecondaryStorageSelector
  • updateHost
  • updateStorage

This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.

  • Published: Nov 27, 2025
  • Updated: Nov 29, 2025
  • CVE: CVE-2025-59302
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 4.7
  • AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CWEs:

Software From Fixed in
apache / cloudstack 4.18.0.0 4.20.2.0
apache / cloudstack 4.21.0.0 4.21.0.0.x