CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. See the original NVD description below for full technical details.
CVE
CVE-2024-29006
Severity
CRITICAL
CVSS
9.8
EPSS
0.87%
Original NVD Description
By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)