CVE-2024-45461
Apache CloudStack Quota plugin: Access checks not enforced in Quota
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false".
Timeline
ID reserved
By apache
- 48 days later
· 48 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| apacheCNA (assigner) | 3.1 | Medium5.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L |
| NVDNVD · Modified | 3.1 | Medium6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.77% · top 44% of all CVEs (9 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.7.
Weakness
Affected products
Apache Software Foundation · Apache CloudStack Quota plugin
- affected 4.7.0 – ≤ 4.18.2.3
- affected 4.19.0.0 – ≤ 4.19.1.1
References (4)
- https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2 (opens in a new tab)vendor-advisorypatch
- https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo (opens in a new tab)mailing-list
- https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-4-and-4-19-1-2/ (opens in a new tab)third-party-advisory
- http://www.openwall.com/lists/oss-security/2024/10/15/3 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-45461)Record last updated .