CVE-2019-10175

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-284 CWE-862

Affected software

Vendor	Product	Versions
KubeVirt	containerized-data-importer	virt-cdi-cloner 1.4

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10175Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10175Issue Tracking, Third Party Advisory

Timeline

Published: Jun 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101765.4A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component we CVE-2019-101776.5A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user in CVE-2019-101786.1It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cro CVE-2019-101796.1A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize re CVE-2019-10187.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thi CVE-2019-101804.8A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several paramet CVE-2019-101818.1It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising th CVE-2019-101826.5It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could t CVE-2019-101833.3Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactio CVE-2019-101847.5undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted thro CVE-2019-101858.6It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. CVE-2019-101868.8A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading a