CVE-2019-10175
CVE-2019-10175
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.5EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
28 Jun 2019Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
KubeVirt · containerized-data-importerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →