What’s Vulnerable › Vulnerabilities

CVE-2024-45462: Apache CloudStack: Incomplete session invalidation on web interface logout

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-16 · updated 2026-06-17
• Weakness: CWE-613

Description

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out user account. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.

Affected products

• Apache Software Foundation Apache CloudStack: from 4.15.1.0 before 4.18.2.4; from 4.19.0.0 before 4.19.1.2 — fixed in 4.18.2.4, 4.19.1.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CloudStack 4.18.2.4, 4.19.1.2. Check the vendor advisory for mitigations.

References

• https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2
• https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2
• https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2
• https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2
• https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo
• http://www.openwall.com/lists/oss-security/2024/10/15/4

Get alerted when CVE-2024-45462 or the next vulnerability affects your stack