CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution

🗓️ 05 Jul 2024 13:40:57Reported by GoogleType

osv🔗 osv.dev👁 24 Views

The CloudStack cluster service has unauthenticated port 9090 with command injection vulnerabilities, allowing remote code execution and compromising confidentiality, integrity, and availability of infrastructure. Upgrade to version 4.18.2.1, 4.19.0.2 or later

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-38346	5 Jul 202416:40	–	circl
CNNVD	Apache CloudStack 代码注入漏洞	5 Jul 202400:00	–	cnnvd
CNVD	Apache CloudStack Code Injection Vulnerability	9 Jul 202400:00	–	cnvd
CVE	CVE-2024-38346	5 Jul 202413:40	–	cve
Cvelist	CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution	5 Jul 202413:40	–	cvelist
EUVD	EUVD-2024-37272	3 Oct 202520:07	–	euvd
NVD	CVE-2024-38346	5 Jul 202414:15	–	nvd
Positive Technologies	PT-2024-27949 · Apache · Apache Cloudstack	5 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-38346	14 Feb 202511:47	–	redhatcve
Vulnrichment	CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution	5 Jul 202413:40	–	vulnrichment

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/07/05/1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38346.json
lists	www.lists.apache.org/thread/6l51r00csrct61plkyd3qg3fj99215d1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-38346
shapeblue	www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-1-and-4-19-0-2/
cloudstack	www.cloudstack.apache.org/blog/security-release-advisory-4.19.0.2-4.18.2.1

15 Jul 2026 01:49Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.8

EPSS0.03301