Unexpected Session Expiration Vulnerability Affects CloudStack Users

CVE-2024-45462

What is CVE-2024-45462?

The logout feature within the Apache CloudStack web interface fails to fully expire user sessions. As a result, even after logging out, sessions can remain valid until they either time out or the backend service is restarted. This vulnerability could allow an attacker, who has gained access to a user's browser, to exploit an unexpired session and access resources belonging to the previously logged-out user. Users utilizing Apache CloudStack versions from 4.15.1.0 to 4.18.2.3 and from 4.19.0.0 to 4.19.1.1 are specifically affected. To mitigate this issue, upgrading to versions 4.18.2.4 or 4.19.1.2 or later is recommended.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References