CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2024-1725
Medium (6.5) in redhat. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/kubevirt/csi-driver 0.0.0-202403081943-cc28dcbb0afc14.
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
- CWE
- CWE-501
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:openshift_container_platform
- redhat:openshift_container_platform_for_arm64
- redhat:openshift_container_platform_for_ibm_z
- redhat:openshift_container_platform_for_linuxone
- redhat:openshift_container_platform_for_power
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fg9q-5cw2-p6r9 | Go | github.com/kubevirt/csi-driver | <0.0.0-202403081943-cc28dcbb0afc14 | 0.0.0-202403081943-cc28dcbb0afc14 |
| GO-2025-3512 | Go | github.com/kubevirt/csi-driver | all versions | no fix published |