Vulnerability · Published Jun 1, 2023 · Assigned by suse
CVE-2023-22648
High 8.0
In plain English
A high-severity security flaw in Rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.6.13 | GHSA-vf6j-6739-78m8 |
| Go | github.com/rancher/rancher | 2.7.4 | GHSA-vf6j-6739-78m8 |
Affected products (as reported)
Weakness: CWE-271 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H