An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local
cluster, resulting in the secret being deleted, but their read-level
permissions to the secret being preserved. When this operation was
followed-up by other specially crafted commands, it could result in the
user gaining access to tokens belonging to service accounts in the local cluster.
This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
References
| Link | Resource |
|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647 | Issue Tracking Vendor Advisory |
| https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6 | Vendor Advisory |
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647 | Issue Tracking Vendor Advisory |
| https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647 - Issue Tracking, Vendor Advisory | |
| References | () https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.9 |
09 Oct 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4. | |
| CWE | CWE-267 |
05 Oct 2023, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
09 Jun 2023, 17:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-281 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| References | (MISC) https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647 - Issue Tracking, Vendor Advisory | |
| References | (MISC) https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6 - Vendor Advisory | |
| CPE | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | |
| First Time |
Suse rancher
Suse |
01 Jun 2023, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-01 13:15
Updated : 2024-11-21 07:45
NVD link : CVE-2023-22647
Mitre link : CVE-2023-22647
CVE.ORG link : CVE-2023-22647
JSON object : View
Products Affected
suse
- rancher
CWE