Apache CloudStack Backup Plugin Improper Access Vulnerability Allowing Unauthorized VM Creation

A vulnerability in the Apache CloudStack Backup plugin, present in versions 4.21.0.0 and 4.22.0.0, allows authenticated users to create new virtual machines (VMs) using backups from other users. This issue arises from improper access logic in the backup plugin, which is enabled in certain environments. Users with access to specific APIs can exploit this vulnerability to misuse backups that do not belong to them.

Impact

Exploitation of this vulnerability allows unauthorized users to create VMs from backups of other users, potentially leading to unauthorized access or use of data.

Remediation

Users are advised to upgrade to Apache CloudStack version 4.22.0.1 or later, which addresses this vulnerability.