Analysis Summary

CVE-2024-41107

Apache CloudStack could allow a remote attacker to bypass security restrictions, caused by not enforce signature check in SAML authentication. By submitting a spoofed SAML response, an attacker could exploit this vulnerability to compromise the resources owned and/or accessible by a SAML enabled user-account.

Impact

• Security Bypass

Indicators of Compromise

CVE

• CVE-2024-41107

Affected Vendors

Remediation

Upgrade to the latest version of Apache CloudStack, available from the Apache Website.

Apache Website