CVE-2023-22650
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SUSE | rancher | 2.7.0 < 2.7.14 | affected |
| SUSE | rancher | 2.8.0 < 2.8.5 | affected |
Weaknesses
- CWE-287: CWE-287 Improper Authentication
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650
- https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.