Apache CloudStack Access Control Vulnerability Leading to Unauthorized Data Access

An access control vulnerability has been identified in Apache CloudStack versions 4.0.0 prior to 4.20.2 and 4.21.0 prior to 4.22.0. This vulnerability affects several APIs, including createNetworkACL, listNetworkACLs, listResourceDetails, listVirtualMachinesUsageHistory, and listVolumesUsageHistory. While these APIs are restricted to authorized users, the lack of proper permission validation allowed some users to access information beyond their intended limits.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information through the affected APIs.

Remediation

Users are advised to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, both of which address this vulnerability.