← CVE Intelligence

CVE-2025-14459

Virt-cdi-controller: unauthorized pvc cloning via dataimportcron PUBLISHED

Description (CNA)

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.

Affected (CNA)

Vendor / productVersions
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-4 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-3 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17.rhel9-82 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-4 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-4 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-4 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-7 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-7 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-6 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-85 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-11 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-19 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-88 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-8 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-8 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-8 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-7 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-7 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-7 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-8 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-8 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-4 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-9 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-12 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / RHEL-9-CNV-4.19unaffected v4.19.17-5 before *
Red Hat / Red Hat OpenShift Virtualization 4unaffected

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.