An unauthenticated vulnerability in Apache CloudStack allows for the potential exposure of sensitive information stored in cleartext within the database.

This vulnerability is a cleartext storage of sensitive information flaw (CWE-312) occurring within the AsyncJob storage component. An unauthenticated attacker can potentially access this sensitive data directly from the underlying database, as the information is not properly encrypted or obfuscated.

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive data managed by the CloudStack environment. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to organizational confidentiality, particularly if the stored information includes administrative credentials or proprietary system configuration data.

Immediate Action: Upgrade to Apache CloudStack version 4.20.3.1, 4.22.1.1, or later to ensure sensitive AsyncJob data is stored securely.

Proactive Monitoring: Review database audit logs for unauthorized access patterns or suspicious queries targeting the AsyncJob tables.

Compensating Controls: Implement strict database access controls and network segmentation to limit exposure of the backend database to only necessary application components.

Public Exploit Available: No

This vulnerability represents a significant risk to the confidentiality of the CloudStack infrastructure. Administrators must prioritize the application of the vendor-provided patches, 4.20.3.1 or 4.22.1.1, to remediate the underlying storage flaw and protect sensitive system information from unauthorized access.