6.5

CVE-2024-1725

Kubevirt-csi: persistentvolume allows access to hcp's root node

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.63% 0.454
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-501 Trust Boundary Violation

The product mixes trusted and untrusted data in the same data structure or structured message.

https://access.redhat.com/errata/RHSA-2024:1559
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:1891
Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:2047
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-1725
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2265398
Issue Tracking