CVE Explorer
CVE-2025-66172
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs.
Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Apache CloudStack","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.22.0.0","status":"affected","version":"4.21.0.0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:fdbbd5595ca375e63f02cd5953d2382a477583ff255ae962b1cb6499829ed901 · sha256:17628894e561e762… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:fdbbd5595ca375e63f02cd5953d2382a477583ff255ae962b1cb6499829ed901 · sha256:17628894e561e762… · /containers/adp/0/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-359","description":"CWE-359 Exposure of Private Personal Information to an Unauthorized Actor","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:fdbbd5595ca375e63f02cd5953d2382a477583ff255ae962b1cb6499829ed901 · sha256:17628894e561e762… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"url":"http://www.openwall.com/lists/oss-security/2026/05/09/3"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:fdbbd5595ca375e63f02cd5953d2382a477583ff255ae962b1cb6499829ed901 · sha256:17628894e561e762… · /containers/adp/1/references/0
{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/n8mt5b7wkpysstb8w7rr9f02kc5cq2xm"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:fdbbd5595ca375e63f02cd5953d2382a477583ff255ae962b1cb6499829ed901 · sha256:17628894e561e762… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.