« Volver al listado

CVE-2025-47713

Estado: AnalizadaAlta (8.8)—

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.

Detalles técnicos trazas, registros y código del informe original
Users are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:
  *  Strict validation on Role Type hierarchy: the caller's user-account role must be equal to or higher than the target user-account's role.
  *  API privilege comparison: the caller must possess all privileges of the user they are operating on. 
  *  Two new domain-level settings (restricted to the default Admin): 
 - role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: "Admin, DomainAdmin, ResourceAdmin". 
   - allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Domain Admin local al dominio ROOT ejecuta escalada mediante reset de contraseña de Admin en servicio remoto CloudStack (PR:L, AV:N); obtiene control de cuentas privilegiadas (T1068), manipula identidades (T1098.002) y compromete integridad de datos (C:H, I:H).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Apache — Cloudstack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47713",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47713",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-14T03:56:15.567859Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache CloudStack",
          "versions": [
            {
              "status": "affected",
              "version": "4.10.0",
              "lessThan": "4.19.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.20.0.0",
              "lessThan": "4.20.1.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-10T23:15:58.320",
  "references": [
    {
      "url": "https://cloudstack.apache.org/blog/cve-advisories-4.19.3.0-4.20.1.0/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/y3qnwn59t8qggtdohv7k7vw39bgb3d60",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-19-3-0-and-4-20-1-0/",
      "tags": [
        "Broken Link"
      ],
      "source": "security@apache.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume control over higher-privileged user-accounts. A malicious Domain Admin attacker can impersonate an Admin user-account and gain access to sensitive APIs and resources that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of infrastructure managed by CloudStack.\n\n\n\nUsers are recommended to upgrade to Apache CloudStack 4.19.3.0 or 4.20.1.0, which fixes the issue with the following:\n  *  Strict validation on Role Type hierarchy: the caller's user-account role must be equal to or higher than the target user-account's role.\n  *  API privilege comparison: the caller must possess all privileges of the user they are operating on. \n  *  Two new domain-level settings (restricted to the default Admin): \n - role.types.allowed.for.operations.on.accounts.of.same.role.type: Defines which role types are allowed to act on users of the same role type. Default: \"Admin, DomainAdmin, ResourceAdmin\". \n   - allow.operations.on.users.in.same.account: Allows/disallows user operations within the same account. Default: true."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de escalada de privilegios en Apache CloudStack, versiones 4.10.0.0 a 4.20.0.0, donde un usuario administrador de dominio malintencionado en el dominio ROOT puede restablecer la contraseña de las cuentas de usuario con el rol de administrador. Esta operación no está restringida adecuadamente y permite al atacante asumir el control de cuentas de usuario con privilegios más altos. Un atacante malintencionado de dominio puede suplantar una cuenta de usuario administrador y obtener acceso a API y recursos confidenciales, lo que podría comprometer la integridad y confidencialidad de los recursos, la pérdida de datos, la denegación de servicio y la disponibilidad de la infraestructura administrada por CloudStack. Se recomienda a los usuarios actualizar a Apache CloudStack 4.19.3.0 o 4.20.1.0, que soluciona el problema con lo siguiente: * Validación estricta en la jerarquía de tipos de rol: el rol de la cuenta de usuario del llamante debe ser igual o superior al rol de la cuenta de usuario de destino. * Comparación de privilegios de API: el usuario que realiza la llamada debe tener todos los privilegios del usuario con el que opera. * Dos nuevas configuraciones a nivel de dominio (restringidas al administrador predeterminado): - role.types.allowed.for.operations.on.accounts.of.same.role.type: Define qué tipos de rol pueden actuar sobre usuarios del mismo tipo. Predeterminado: \"Admin, DomainAdmin, ResourceAdmin\". - allow.operations.on.users.in.same.account: Permite o impide las operaciones de usuario dentro de la misma cuenta. Predeterminado: true."
    }
  ],
  "lastModified": "2026-06-17T09:28:36.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F76F9027-3B50-4AEA-8E3D-E0C8A4E256A8",
              "versionEndExcluding": "4.19.3.0",
              "versionStartIncluding": "4.10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:cloudstack:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67E1FECD-94E6-4B2A-A52D-47D7FC8C9B10",
              "versionEndExcluding": "4.20.1.0",
              "versionStartIncluding": "4.20.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}