Lucene search

ApacheCVE-2024-41107

HistoryJul 19, 2024 - 11:15 a.m.

CVE-2024-41107

2024-07-1911:15:03

CWE-290

apache

web.nvd.nist.gov

apache cloudstack

saml

signature exclusion

authentication

spoofing

compromise

security

vulnerability

upgrade

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.839

Percentile

98.5%

JSON

The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account.

Affected users are recommended to disable the SAML authentication plugin by setting the “saml2.enabled” global setting to “false”, or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

apachecloudstackRange4.5.0–4.18.2.2

apachecloudstackRange4.19.0.0–4.19.1.0

VendorProductVersionCPE
apachecloudstack*cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	cloudstack	*	cpe:2.3:a:apache:cloudstack::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache CloudStack",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "4.18.2.1",
        "status": "affected",
        "version": "4.5.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "4.19.0.2",
        "status": "affected",
        "version": "4.19.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2024/07/19/1

www.openwall.com/lists/oss-security/2024/07/19/2

cloudstack.apache.org/blog/security-release-advisory-cve-2024-41107

github.com/apache/cloudstack/issues/4519

lists.apache.org/thread/5q06g8zvmhcw6w3tjr6r5prqdw6zckg3

www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-cve-2024-41107

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.839

Percentile

98.5%

JSON

Related for CVE-2024-41107