CVE-2024-1725 - Vulnerability Details

Vendors	Products
Redhat	Openshift Openshift Container Platform Openshift Container Platform For Arm64 Openshift Container Platform For Ibm Z Openshift Container Platform For Linuxone Openshift Container Platform For Power

Package	CPE	Advisory	Released Date
Red Hat OpenShift Container Platform 4.13
openshift4/kubevirt-csi-driver-rhel8:v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8	cpe:/a:redhat:openshift:4.13::el8	RHSA-2024:2047	2024-05-02T00:00:00Z
Red Hat OpenShift Container Platform 4.14
openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8	cpe:/a:redhat:openshift:4.14::el8	RHSA-2024:1891	2024-04-26T00:00:00Z
Red Hat OpenShift Container Platform 4.15
openshift4/kubevirt-csi-driver-rhel8:v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8	cpe:/a:redhat:openshift:4.15::el8	RHSA-2024:1559	2024-04-02T00:00:00Z

Link	Providers
https://access.redhat.com/errata/RHSA-2024:1559
https://access.redhat.com/errata/RHSA-2024:1891
https://access.redhat.com/errata/RHSA-2024:2047
https://access.redhat.com/security/cve/CVE-2024-1725
https://bugzilla.redhat.com/show_bug.cgi?id=2265398
https://nvd.nist.gov/vuln/detail/CVE-2024-1725
https://www.cve.org/CVERecord?id=CVE-2024-1725

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Type	Values Removed	Values Added
First Time appeared		Redhat openshift Container Platform Redhat openshift Container Platform For Arm64 Redhat openshift Container Platform For Ibm Z Redhat openshift Container Platform For Linuxone Redhat openshift Container Platform For Power
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:redhat:openshift_container_platform:4.13:::::::* cpe:2.3:a:redhat:openshift_container_platform:4.14:::::::* cpe:2.3:a:redhat:openshift_container_platform:4.15:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.13:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.14:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.15:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.13:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.14:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.15:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.13:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.14:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.15:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.13:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.14:::::::* cpe:2.3:a:redhat:openshift_container_platform_for_power:4.15:::::::*
Vendors & Products		Redhat openshift Container Platform Redhat openshift Container Platform For Arm64 Redhat openshift Container Platform For Ibm Z Redhat openshift Container Platform For Linuxone Redhat openshift Container Platform For Power

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1725", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-02-21T20:27:59.807Z", "datePublished": "2024-03-07T20:09:11.616Z", "dateUpdated": "2025-03-26T04:52:26.156Z"}, "containers": {"cna": {"title": "Kubevirt-csi: persistentvolume allows access to hcp's root node", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node."}], "affected": [{"repo": "https://github.com/openshift/kubevirt-csi-driver/", "versions": [{"status": "unaffected", "version": "a61f36c42700f54352919318ed806d1ae2d716f4", "lessThan": "*", "versionType": "git"}], "packageName": "kubevirt-csi-driver", "collectionURL": "https://github.com/openshift/kubevirt-csi-driver/"}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/kubevirt-csi-driver-rhel8", "defaultStatus": "affected", "versions": [{"version": "v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.13::el9", "cpe:/a:redhat:openshift:4.13::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/kubevirt-csi-driver-rhel8", "defaultStatus": "affected", "versions": [{"version": "v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.14::el9", "cpe:/a:redhat:openshift:4.14::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/kubevirt-csi-driver-rhel8", "defaultStatus": "affected", "versions": [{"version": "v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.15::el9", "cpe:/a:redhat:openshift:4.15::el8"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1559", "name": "RHSA-2024:1559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:1891", "name": "RHSA-2024:1891", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:2047", "name": "RHSA-2024:2047", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1725", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398", "name": "RHBZ#2265398", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-03-06T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-501", "description": "Trust Boundary Violation", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-501: Trust Boundary Violation", "timeline": [{"lang": "en", "time": "2024-02-19T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-03-06T00:00:00+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-03-26T04:52:26.156Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.831Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1559", "name": "RHSA-2024:1559", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:1891", "name": "RHSA-2024:1891", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:2047", "name": "RHSA-2024:2047", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1725", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398", "name": "RHBZ#2265398", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-12T18:08:26.582074Z", "id": "CVE-2024-1725", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:40:55.445Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-1725 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

state : PUBLISHED (string)

assignerShortName : redhat (string)

dateReserved : 2024-02-21T20:27:59.807Z (string)

datePublished : 2024-03-07T20:09:11.616Z (string)

dateUpdated : 2025-03-26T04:52:26.156Z (string)

}

containers : { »

cna : { »

title : Kubevirt-csi: persistentvolume allows access to hcp's root node (string)

metrics : [ »

0 : { »

other : { »

content : { »

value : Important (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

type : Red Hat severity rating (string)

}

1 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. (string)

}

]

affected : [ »

0 : { »

repo : https://github.com/openshift/kubevirt-csi-driver/ (string)

versions : [ »

0 : { »

status : unaffected (string)

version : a61f36c42700f54352919318ed806d1ae2d716f4 (string)

lessThan : * (string)

versionType : git (string)

}

]

packageName : kubevirt-csi-driver (string)

collectionURL : https://github.com/openshift/kubevirt-csi-driver/ (string)

}

1 : { »

vendor : Red Hat (string)

product : Red Hat OpenShift Container Platform 4.13 (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

packageName : openshift4/kubevirt-csi-driver-rhel8 (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/a:redhat:openshift:4.13::el9 (string)

1 : cpe:/a:redhat:openshift:4.13::el8 (string)

]

}

2 : { »

vendor : Red Hat (string)

product : Red Hat OpenShift Container Platform 4.14 (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

packageName : openshift4/kubevirt-csi-driver-rhel8 (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/a:redhat:openshift:4.14::el9 (string)

1 : cpe:/a:redhat:openshift:4.14::el8 (string)

]

}

3 : { »

vendor : Red Hat (string)

product : Red Hat OpenShift Container Platform 4.15 (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

packageName : openshift4/kubevirt-csi-driver-rhel8 (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8 (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/a:redhat:openshift:4.15::el9 (string)

1 : cpe:/a:redhat:openshift:4.15::el8 (string)

]

}

]

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:1559 (string)

name : RHSA-2024:1559 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:1891 (string)

name : RHSA-2024:1891 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://access.redhat.com/errata/RHSA-2024:2047 (string)

name : RHSA-2024:2047 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : https://access.redhat.com/security/cve/CVE-2024-1725 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

4 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

name : RHBZ#2265398 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

datePublic : 2024-03-06T00:00:00.000Z (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-501 (string)

description : Trust Boundary Violation (string)

lang : en (string)

type : CWE (string)

}

]

}

]

x_redhatCweChain : CWE-501: Trust Boundary Violation (string)

timeline : [ »

0 : { »

lang : en (string)

time : 2024-02-19T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2024-03-06T00:00:00+00:00 (string)

value : Made public. (string)

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2025-03-26T04:52:26.156Z (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:48:21.831Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:1559 (string)

name : RHSA-2024:1559 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:1891 (string)

name : RHSA-2024:1891 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://access.redhat.com/errata/RHSA-2024:2047 (string)

name : RHSA-2024:2047 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : https://access.redhat.com/security/cve/CVE-2024-1725 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

4 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

name : RHBZ#2265398 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-03-12T18:08:26.582074Z (string)

id : CVE-2024-1725 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-12T20:40:55.445Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1559", "name": "RHSA-2024:1559", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:1891", "name": "RHSA-2024:1891", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:2047", "name": "RHSA-2024:2047", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1725", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398", "name": "RHBZ#2265398", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:21.831Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-12T18:08:26.582074Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:40:52.302Z"}}], "cna": {"title": "Kubevirt-csi: persistentvolume allows access to hcp's root node", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/openshift/kubevirt-csi-driver/", "versions": [{"status": "unaffected", "version": "a61f36c42700f54352919318ed806d1ae2d716f4", "lessThan": "*", "versionType": "git"}], "packageName": "kubevirt-csi-driver", "collectionURL": "https://github.com/openshift/kubevirt-csi-driver/"}, {"cpes": ["cpe:/a:redhat:openshift:4.13::el9", "cpe:/a:redhat:openshift:4.13::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "versions": [{"status": "unaffected", "version": "v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/kubevirt-csi-driver-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.14::el9", "cpe:/a:redhat:openshift:4.14::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/kubevirt-csi-driver-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9", "cpe:/a:redhat:openshift:4.15::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/kubevirt-csi-driver-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2024-02-19T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-03-06T00:00:00+00:00", "value": "Made public."}], "datePublic": "2024-03-06T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1559", "name": "RHSA-2024:1559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:1891", "name": "RHSA-2024:1891", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:2047", "name": "RHSA-2024:2047", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1725", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398", "name": "RHBZ#2265398", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-501", "description": "Trust Boundary Violation"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-03-26T04:52:26.156Z"}, "x_redhatCweChain": "CWE-501: Trust Boundary Violation"}}, "cveMetadata": {"cveId": "CVE-2024-1725", "state": "PUBLISHED", "dateUpdated": "2025-03-26T04:52:26.156Z", "dateReserved": "2024-02-21T20:27:59.807Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-03-07T20:09:11.616Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:1559 (string)

name : RHSA-2024:1559 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:1891 (string)

name : RHSA-2024:1891 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://access.redhat.com/errata/RHSA-2024:2047 (string)

name : RHSA-2024:2047 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : https://access.redhat.com/security/cve/CVE-2024-1725 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

4 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

name : RHBZ#2265398 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:48:21.831Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-1725 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-03-12T18:08:26.582074Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-12T20:40:52.302Z (string)

}

]

cna : { »

title : Kubevirt-csi: persistentvolume allows access to hcp's root node (string)

metrics : [ »

0 : { »

other : { »

type : Red Hat severity rating (string)

content : { »

value : Important (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

1 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

repo : https://github.com/openshift/kubevirt-csi-driver/ (string)

versions : [ »

0 : { »

status : unaffected (string)

version : a61f36c42700f54352919318ed806d1ae2d716f4 (string)

lessThan : * (string)

versionType : git (string)

}

]

packageName : kubevirt-csi-driver (string)

collectionURL : https://github.com/openshift/kubevirt-csi-driver/ (string)

}

1 : { »

cpes : [ »

0 : cpe:/a:redhat:openshift:4.13::el9 (string)

1 : cpe:/a:redhat:openshift:4.13::el8 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenShift Container Platform 4.13 (string)

versions : [ »

0 : { »

status : unaffected (string)

version : v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : openshift4/kubevirt-csi-driver-rhel8 (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

defaultStatus : affected (string)

}

2 : { »

cpes : [ »

0 : cpe:/a:redhat:openshift:4.14::el9 (string)

1 : cpe:/a:redhat:openshift:4.14::el8 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenShift Container Platform 4.14 (string)

versions : [ »

0 : { »

status : unaffected (string)

version : v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : openshift4/kubevirt-csi-driver-rhel8 (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

defaultStatus : affected (string)

}

3 : { »

cpes : [ »

0 : cpe:/a:redhat:openshift:4.15::el9 (string)

1 : cpe:/a:redhat:openshift:4.15::el8 (string)

]

vendor : Red Hat (string)

product : Red Hat OpenShift Container Platform 4.15 (string)

versions : [ »

0 : { »

status : unaffected (string)

version : v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8 (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : openshift4/kubevirt-csi-driver-rhel8 (string)

collectionURL : https://catalog.redhat.com/software/containers/ (string)

defaultStatus : affected (string)

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2024-02-19T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2024-03-06T00:00:00+00:00 (string)

value : Made public. (string)

}

]

datePublic : 2024-03-06T00:00:00.000Z (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:1559 (string)

name : RHSA-2024:1559 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/errata/RHSA-2024:1891 (string)

name : RHSA-2024:1891 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://access.redhat.com/errata/RHSA-2024:2047 (string)

name : RHSA-2024:2047 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : https://access.redhat.com/security/cve/CVE-2024-1725 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

4 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

name : RHBZ#2265398 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-501 (string)

description : Trust Boundary Violation (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2025-03-26T04:52:26.156Z (string)

}

x_redhatCweChain : CWE-501: Trust Boundary Violation (string)

}

cveMetadata : { »

cveId : CVE-2024-1725 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-26T04:52:26.156Z (string)

dateReserved : 2024-02-21T20:27:59.807Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2024-03-07T20:09:11.616Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:*", "matchCriteriaId": "1FFF1D51-ABA8-4E54-B81C-A88C8A5E4842", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:*", "matchCriteriaId": "486B3F69-1551-4F8B-B25B-A5864248811B", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "4716808D-67EB-4E14-9910-B248A500FAFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.13:*:*:*:*:*:*:*", "matchCriteriaId": "226AD7DB-D8CB-45A3-97AE-3FE79774133E", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.14:*:*:*:*:*:*:*", "matchCriteriaId": "1B361729-2847-4FE1-9503-BF9FA81307C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "FA5959A2-F48B-449B-89AD-ECDE9E5418E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.13:*:*:*:*:*:*:*", "matchCriteriaId": "08B9C7A4-4D65-4771-B92D-914C9C9A6C4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.14:*:*:*:*:*:*:*", "matchCriteriaId": "99ADC66F-3B19-4767-B876-67BA1C8D195B", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "E4F24706-3DF4-49D0-870D-39D4FC02CF4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.13:*:*:*:*:*:*:*", "matchCriteriaId": "BDD2E6ED-9BDE-404B-AD0D-F78D69B13B34", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.14:*:*:*:*:*:*:*", "matchCriteriaId": "065C13FF-588E-42F5-B3C9-3302082E6524", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "C1E0DF9A-C358-48A0-911F-0A17E1982E4B", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_power:4.13:*:*:*:*:*:*:*", "matchCriteriaId": "8FF27781-22D9-4283-959D-951C76429EF5", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_power:4.14:*:*:*:*:*:*:*", "matchCriteriaId": "F68F84F5-7671-4778-AE48-5CF243B62D88", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openshift_container_platform_for_power:4.15:*:*:*:*:*:*:*", "matchCriteriaId": "33D2A2D4-A006-422D-AA0C-8E764FB104C5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente kubevirt-csi del plano de control alojado (HCP) de OpenShift Virtualization. Este problema podr\u00eda permitir que un atacante autenticado obtenga acceso al volumen del nodo trabajador HCP ra\u00edz mediante la creaci\u00f3n de un volumen persistente personalizado que coincida con el nombre de un nodo trabajador."}], "id": "CVE-2024-1725", "lastModified": "2025-03-26T05:15:40.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2024-03-07T20:15:50.690", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:1559"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:1891"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:2047"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-1725"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:1559"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:1891"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/errata/RHSA-2024:2047"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-1725"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-501"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:* (string)

matchCriteriaId : 1FFF1D51-ABA8-4E54-B81C-A88C8A5E4842 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform:4.14:*:*:*:*:*:*:* (string)

matchCriteriaId : 486B3F69-1551-4F8B-B25B-A5864248811B (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform:4.15:*:*:*:*:*:*:* (string)

matchCriteriaId : 4716808D-67EB-4E14-9910-B248A500FAFA (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.13:*:*:*:*:*:*:* (string)

matchCriteriaId : 226AD7DB-D8CB-45A3-97AE-3FE79774133E (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.14:*:*:*:*:*:*:* (string)

matchCriteriaId : 1B361729-2847-4FE1-9503-BF9FA81307C5 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_arm64:4.15:*:*:*:*:*:*:* (string)

matchCriteriaId : FA5959A2-F48B-449B-89AD-ECDE9E5418E6 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.13:*:*:*:*:*:*:* (string)

matchCriteriaId : 08B9C7A4-4D65-4771-B92D-914C9C9A6C4A (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.14:*:*:*:*:*:*:* (string)

matchCriteriaId : 99ADC66F-3B19-4767-B876-67BA1C8D195B (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.15:*:*:*:*:*:*:* (string)

matchCriteriaId : E4F24706-3DF4-49D0-870D-39D4FC02CF4A (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.13:*:*:*:*:*:*:* (string)

matchCriteriaId : BDD2E6ED-9BDE-404B-AD0D-F78D69B13B34 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.14:*:*:*:*:*:*:* (string)

matchCriteriaId : 065C13FF-588E-42F5-B3C9-3302082E6524 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.15:*:*:*:*:*:*:* (string)

matchCriteriaId : C1E0DF9A-C358-48A0-911F-0A17E1982E4B (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_power:4.13:*:*:*:*:*:*:* (string)

matchCriteriaId : 8FF27781-22D9-4283-959D-951C76429EF5 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_power:4.14:*:*:*:*:*:*:* (string)

matchCriteriaId : F68F84F5-7671-4778-AE48-5CF243B62D88 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:redhat:openshift_container_platform_for_power:4.15:*:*:*:*:*:*:* (string)

matchCriteriaId : 33D2A2D4-A006-422D-AA0C-8E764FB104C5 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. (string)

}

1 : { »

lang : es (string)

value : Se encontró una falla en el componente kubevirt-csi del plano de control alojado (HCP) de OpenShift Virtualization. Este problema podría permitir que un atacante autenticado obtenga acceso al volumen del nodo trabajador HCP raíz mediante la creación de un volumen persistente personalizado que coincida con el nombre de un nodo trabajador. (string)

}

]

id : CVE-2024-1725 (string)

lastModified : 2025-03-26T05:15:40.107 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : secalert@redhat.com (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Secondary (string)

}

]

}

published : 2024-03-07T20:15:50.690 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:1559 (string)

}

1 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:1891 (string)

}

2 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:2047 (string)

}

3 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2024-1725 (string)

}

4 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Issue Tracking (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:1559 (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:1891 (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/errata/RHSA-2024:2047 (string)

}

8 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2024-1725 (string)

}

9 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-501 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2024:2047", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "package": "openshift4/kubevirt-csi-driver-rhel8:v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2024-05-02T00:00:00Z"}, {"advisory": "RHSA-2024:1891", "cpe": "cpe:/a:redhat:openshift:4.14::el8", "package": "openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8", "product_name": "Red Hat OpenShift Container Platform 4.14", "release_date": "2024-04-26T00:00:00Z"}, {"advisory": "RHSA-2024:1559", "cpe": "cpe:/a:redhat:openshift:4.15::el8", "package": "openshift4/kubevirt-csi-driver-rhel8:v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8", "product_name": "Red Hat OpenShift Container Platform 4.15", "release_date": "2024-04-02T00:00:00Z"}], "bugzilla": {"description": "kubevirt-csi: PersistentVolume allows access to HCP's root node", "id": "2265398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265398"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "verified"}, "cwe": "CWE-501", "details": ["A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.", "A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node."], "name": "CVE-2024-1725", "public_date": "2024-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-1725\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-1725"], "threat_severity": "Important"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2024:2047 (string)

cpe : cpe:/a:redhat:openshift:4.13::el8 (string)

package : openshift4/kubevirt-csi-driver-rhel8:v4.13.0-202404200313.p0.g9d909f7.assembly.stream.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.13 (string)

release_date : 2024-05-02T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2024:1891 (string)

cpe : cpe:/a:redhat:openshift:4.14::el8 (string)

package : openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.14 (string)

release_date : 2024-04-26T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2024:1559 (string)

cpe : cpe:/a:redhat:openshift:4.15::el8 (string)

package : openshift4/kubevirt-csi-driver-rhel8:v4.15.0-202403220332.p0.gd3bdbce.assembly.stream.el8 (string)

product_name : Red Hat OpenShift Container Platform 4.15 (string)

release_date : 2024-04-02T00:00:00Z (string)

}

]

bugzilla : { »

description : kubevirt-csi: PersistentVolume allows access to HCP's root node (string)

id : 2265398 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2265398 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 6.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

status : verified (string)

}

cwe : CWE-501 (string)

details : [ »

0 : A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. (string)

1 : A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node. (string)

]

name : CVE-2024-1725 (string)

public_date : 2024-03-06T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2024-1725 https://nvd.nist.gov/vuln/detail/CVE-2024-1725 (string)

]

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object