Technical impact
The issue is a cleartext storage of sensitive information in Apache CloudStack's AsyncJob database table. Sensitive data, such as internal credentials or configuration details, is persisted without encryption, allowing an attacker who can read the database to obtain that information. This leads directly to information disclosure and can compromise the confidentiality of the system.
Affected Systems
The vulnerability affects Apache CloudStack deployments, specifically all releases from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Any instance running those versions is exposed to the risk.
Risk and Exploitability
An attacker would need access to the CloudStack database or a privileged user that can read its tables; no publicly disclosed exploit tools are known, and the EPSS score is < 1%. The CVSS score of 7.5 indicates a high severity vulnerability that is listed as not in CISA's KEV catalog, implying it has not yet been actively exploited. However, because the data is stored in cleartext, a compromised database grants direct exposure of sensitive values.
