A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users
while they are logged in the Rancher UI. This would cause the users to
retain their previous permissions in Rancher, even if they change groups
on Azure AD, for example, to a lower privileged group, or are removed
from a group, thus retaining their access to Rancher instead of losing
it.
This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
References
| Link | Resource |
|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 | Issue Tracking Vendor Advisory |
| https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 | Vendor Advisory |
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 | Issue Tracking Vendor Advisory |
| https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:45
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| References | () https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 - Issue Tracking, Vendor Advisory | |
| References | () https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - Vendor Advisory |
09 Oct 2024, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4. | |
| CWE | CWE-271 |
05 Oct 2023, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
09 Jun 2023, 17:23
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Suse rancher
Suse |
|
| CPE | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | |
| CWE | CWE-384 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (MISC) https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - Vendor Advisory | |
| References | (MISC) https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 - Issue Tracking, Vendor Advisory |
01 Jun 2023, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-01 13:15
Updated : 2024-11-21 07:45
NVD link : CVE-2023-22648
Mitre link : CVE-2023-22648
CVE.ORG link : CVE-2023-22648
JSON object : View
Products Affected
suse
- rancher
CWE