PT-2019-11605 · Unknown · Virt-Cdi-Cloner

Published 2019-06-28 · Updated 2020-10-01 · CVE-2019-10175

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: virt-cdi-cloner version 1.4

Description: A flaw in the containerized-data-importer of virt-cdi-cloner allows users to clone any Persistent Volume Claim (PVC) in the cluster into their own namespace, effectively granting access to other users' data. This occurs because the host-assisted cloning feature does not verify whether the requesting user has permission to access the PVC in the source namespace.

Recommendations: For virt-cdi-cloner version 1.4, consider restricting access to the host-assisted cloning feature until a patch is available to ensure that users can only clone PVCs they have permission to access.

Fix

Missing Authorization

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-862

CWE-284

CWE-200

Related Identifiers

CVE-2019-10175

Affected Products

Virt-Cdi-Cloner

References · 3

• https://osv.dev/vulnerability/CVE-2019-10175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10175 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10175 · Note