{"id":"CVE-2025-59302","title":"Apache CloudStack: Potential remote code execution on Javascript engine defined rules","summary":"In  Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.\n\n  *  quotaTariffCreate\n  *  quotaTariffUpdate\n  *  createSecondaryStorageS…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","cvssSource":"adp","cwe":["CWE-94"],"vendor":"Apache Software Foundation","product":"Apache CloudStack","affected":["apache_cloudstack >= 4.18.0 < 4.20.2","apache_cloudstack >= 4.21.0 < 4.22.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-12-02T04:56:00.679228Z"},"published":"2025-11-27","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:03:06.484Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-59302","references":[{"url":"https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788"}],"tags":["cve.org"],"epss":0.0049,"epssPercentile":0.424,"ingestedAt":"2026-11-05T20:33:06.567Z","slug":"CVE-2025-59302","body":"## Overview\n\nIn  Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.\n\n  *  quotaTariffCreate\n  *  quotaTariffUpdate\n  *  createSecondaryStorageSelector\n  *  updateSecondaryStorageSelector\n  *  updateHost\n  *  updateStorage\n\n\nThis issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.\n\nThe fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.\n\n## Affected\n\n- `apache_cloudstack >= 4.18.0 < 4.20.2`\n- `apache_cloudstack >= 4.21.0 < 4.22.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}