4.8

CVE-2026-61399

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Cloudstack Version >= 4.20.0.0 < 4.20.3.1
Apache ≫ Cloudstack Version >= 4.21.0.0 < 4.22.1.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE-116 Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc
Vendor Advisory
Mailing List