Apache CloudStack Backup Plugin Improper Authorization Vulnerability

A vulnerability exists in the CloudStack Backup plugin in Apache CloudStack versions 4.21.0.0 and 4.22.0.0, due to improper authorization logic. In environments where this plugin is enabled, authenticated users can access specific APIs to list backups from any account. However, this vulnerability does not allow access to the contents of the backups.

Impact

Exploitation of this vulnerability allows unauthorized access to backup lists from other accounts, potentially leading to misuse of backup data.

Remediation

Users are advised to upgrade to Apache CloudStack version 4.22.0.1 or later, which addresses this vulnerability.