Description
In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. * quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix. The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
INFO
Published Date :
2025-11-27T11:46:25.521Z
Last Modified :
2026-02-26T16:07:27.738Z
Source :
apache
AFFECTED PRODUCTS
The following products are affected by CVE-2025-59302 vulnerability.
| Vendors | Products |
|---|---|
| Apache |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-59302.
