Vulnerability Details : CVE-2020-14316
A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Products affected by CVE-2020-14316
- cpe:2.3:a:redhat:openshift_virtualization:1:*:*:*:*:*:*:*
- cpe:2.3:a:kubevirt:kubevirt:*:*:*:*:*:kubernetes:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-14316
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-14316
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
NIST |
References for CVE-2020-14316
-
https://bugzilla.redhat.com/show_bug.cgi?id=1848951
1848951 – (CVE-2020-14316) CVE-2020-14316 kubevirt: VMIs can be used to access host filesIssue Tracking;Patch;Third Party Advisory
Jump to