Vulnerability · Published Oct 16, 2024 · Assigned by suse
CVE-2023-22650Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
High 8.8
In plain English
A high-severity improper authentication in rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.7.14 | GHSA-9ghh-mmcq-8phc |
| Go | github.com/rancher/rancher | 2.8.5 | GHSA-9ghh-mmcq-8phc |
| Go | github.com/rancher/rancher | no fix listed | GO-2024-2931 |
Affected products (as reported)
Weakness: CWE-287, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H