How severe is CVE-2024-45462?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.1 out of 10.

What type of vulnerability is CVE-2024-45462?

This is classified as CWE-613, which is a common weakness in software security.

CVE-2024-45462 - HIGH Severity | CVSS 7.1

Vulnerability Description

The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out user account. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.

Related Vulnerabilities

CVE-2019-5647

HIGH

CVSS:7.1(High)

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This behavior could make future session hijacki...

CWE-6132019

CVE-2020-5774

HIGH

CVSS:7.1(High)

Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access ...

CWE-6132020

CVE-2021-31408

HIGH

CVSS:7.1(High)

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combina...

CWE-6132021

CVE-2021-3461

HIGH

CVSS:7.1(High)

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

CWE-6132021

CVE-2023-40025

HIGH

CVSS:7.1(High)

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug where open web terminal sessions do not expire. This bug allows...

CWE-6132023

CVE-2024-45187

HIGH

CVSS:7.1(High)

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code throu...

CWE-6132024