-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kubevirt/csi-driver | go | < 0.0.0-202403081943-cc28dcbb0afc14 | 0.0.0-202403081943-cc28dcbb0afc14 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing validation checks in critical data volume handling functions. The patch added: 1) Mandatory infraClusterLabels, 2) Volume prefix requirements, and 3) Label matching enforcement. The vulnerable functions lacked these security checks in their pre-patch versions, allowing attackers to access arbitrary PVCs by name matching. The commit diff shows these validations were added to CreateDataVolume and GetDataVolume, and the client constructor was modified to require prefix validation.