CVE-2024-41107

The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response with no signature and known or guessed username and other user details of a SAML-enabled CloudStack user-account. In such environments, this can result in a complete compromise of the resources owned and/or accessible by a SAML enabled user-account. Affected users are recommended to disable the SAML authentication plugin by setting the "saml2.enabled" global setting to "false", or upgrade to version 4.18.2.2, 4.19.1.0 or later, which addresses this issue.

• CWE-290

• http://www.openwall.com/lists/oss-security/2024/07/19/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/07/19/2Mailing List, Third Party Advisory
• https://cloudstack.apache.org/blog/security-release-advisory-cve-2024-41107Mitigation, Vendor Advisory
• https://github.com/apache/cloudstack/issues/4519Issue Tracking
• https://lists.apache.org/thread/5q06g8zvmhcw6w3tjr6r5prqdw6zckg3Mailing List, Vendor Advisory
• https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-cve-2024-41107Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/07/19/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/07/19/2Mailing List, Third Party Advisory
• https://cloudstack.apache.org/blog/security-release-advisory-cve-2024-41107Mitigation, Vendor Advisory
• https://github.com/apache/cloudstack/issues/4519Issue Tracking
• https://lists.apache.org/thread/5q06g8zvmhcw6w3tjr6r5prqdw6zckg3Mailing List, Vendor Advisory
• https://www.shapeblue.com/shapeblue-security-advisory-apache-cloudstack-cve-2024-41107Third Party Advisory

Published

Jul 19, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41093In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-41094In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-41095In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-41096In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-41097In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-41098In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-41108FOG is a free open-source cloning/imaging/rescue suite/inven…5.9
• CVE-2024-41109Pimcore's Admin Classic Bundle provides a backend user inter…6.5
• CVE-2024-4111A vulnerability was found in Tenda TX9 22.03.02.10. It has b…8.8
• CVE-2024-41110Moby is an open-source project created by Docker for softwar…9.9
• CVE-2024-41111Sliver is an open source cross-platform adversary emulation/…7.2
• CVE-2024-41112streamlit-geospatial is a streamlit multipage app for geospa…9.8