Skip to content
OpenAdvisories
High WID-SEC-2023-1340 4 CVEs

Rancher: Mehrere Schwachstellen

Published May 31, 2023 · Updated Mar 4, 2026 · Revision 2 · de-DE

Vendor: rancher Product: rancher Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsvorkehrungen zu umgehen oder einen Cross Site Scripting angriff durchzuführen.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 4

  • Critical 9.9
    CVE-2023-22647

    Rancher vulnerable to Privilege Escalation via manipulation of Secrets

    An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the …

    SUSE Rancher github.com/rancher/rancher Go
  • High 8.8
    CVE-2020-10676

    Rancher users retain access after moving namespaces into projects they don't have access to

    In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project.

    github.com/rancher/rancher Go
  • High 8.4
    CVE-2022-43760

    Rancher UI has multiple Cross-Site Scripting (XSS) issues

    An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to stea…

    SUSE Rancher github.com/rancher/rancher Go
  • High 8.0
    CVE-2023-22648

    Rancher's Azure AD permission changes are not reflected on active sessions

    A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they …

    SUSE Rancher github.com/rancher/rancher Go

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2023-26781

  2. #1

    Initiale Fassung

References