Unexpected Session Expiration Vulnerability Affects CloudStack Users

CVE-2024-45462

Summary

The logout feature within the Apache CloudStack web interface fails to fully expire user sessions. As a result, even after logging out, sessions can remain valid until they either time out or the backend service is restarted. This vulnerability could allow an attacker, who has gained access to a user's browser, to exploit an unexpired session and access resources belonging to the previously logged-out user. Users utilizing Apache CloudStack versions from 4.15.1.0 to 4.18.2.3 and from 4.19.0.0 to 4.19.1.1 are specifically affected. To mitigate this issue, upgrading to versions 4.18.2.4 or 4.19.1.2 or later is recommended.

References