A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not deter…

Published 7 y ago 2019-06-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 61%

Public exploits

none known

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.

Exploit prediction (EPSS)

0.95% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:P/I:N/A:N`

Affected products

KubeVirt containerized-data-importer

Classification

Weakness

CWE-284 Improper Access Control
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-862 Missing Authorization

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10175 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2019-10175
NVD: CVE-2019-10175

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.