Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-66171 The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ env… https://www.cve.org/CVERecord?id=CVE-2025-66171
Post summary
The post discloses an improper access control issue in CloudStack Backup plugin (versions 4.21.0.0/4.22.0.0); it does not mention exploits, PoC, patches, or active usage.
CVE-2025-66171 Improper Access Logic in CloudStack Backup Plugin Versions 4.21.0.0 and 4.22.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66171
Post summary
The text references CVE-2025-66171 with a link to a vulnerability page, providing only title-level technical details without any PoC, exploit, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | cloudstack | - | - | - |