CVE-2024-45461 [Medium] | Security Vulnerability in Cloudstack

The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environments where the feature is enabled, due to missing access check enforcements, non-administrative CloudStack user accounts are able to access and modify quota-related configurations and data. This issue affects Apache CloudStack from 4.7.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1, where the Quota feature is enabled. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Alternatively, users that do not use the Quota feature are advised to disabled the plugin by setting the global setting "quota.enable.service" to "false".

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.19%	0.71%	+0.52%
2	2026-06-06	0.14%	0.19%	+0.05%
3	2025-11-21	—	0.14%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.19%

0.71%

+0.52%

2026-06-06

0.14%

0.19%

+0.05%

2025-11-21

—

0.14%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.7	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	0.9	4.7	[email protected]
6.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	2.8	3.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.7

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

0.9

4.7

[email protected]

6.3

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

2.8

3.4

[email protected]

Affected software / configurations for CVE-2024-45461

Vendor	Product	Version	Raw CPE
apache	cloudstack	>= 4.7.0, < 4.18.2.4	cpe:2.3:a:apache:cloudstack::::::::
apache	cloudstack	>= 4.19.0.0, < 4.19.1.2	cpe:2.3:a:apache:cloudstack::::::::

References for CVE-2024-45461

URL	Tags
https://cloudstack.apache.org/blog/security-release-advisory-4.18.2.4-4.19.1.2	Vendor Advisory
https://lists.apache.org/thread/ktsfjcnj22x4kg49ctock3d9tq7jnvlo	Vendor Advisory
https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-security-releases-4-18-2-4-and-4-19-1-2/
http://www.openwall.com/lists/oss-security/2024/10/15/3

URL

CVE-2024-45461 | Apache CloudStack Quota plugin: Access checks not enforced in Quota

Exploit prediction scoring system (EPSS) score for CVE-2024-45461

Common vulnerability scoring system (CVSS) metrics for CVE-2024-45461

Weakness enumeration for CVE-2024-45461

Affected software / configurations for CVE-2024-45461

References for CVE-2024-45461