Skip to content
OpenAdvisories
High WID-SEC-2024-0332 4 CVEs

Rancher: Mehrere Schwachstellen

Published Feb 8, 2024 · Updated Feb 8, 2024 · de-DE

Vendor: rancher Product: rancher Platform: Linux Platform: macOS

Summary

Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Informationen offenzulegen, XSS-Angriffe durchzuführen oder seine Privilegien zu erweitern.

Product

Rancher ist ein Werkzeug für die Verwaltung von Kubernetes-Container basierten Umgebungen.

Vulnerabilities 4

  • High 8.4
    CVE-2023-22649

    Rancher 'Audit Log' leaks sensitive information

    A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only de…

    SUSE Rancher github.com/rancher/rancher Go
  • High 8.3
    CVE-2023-32192

    Rancher API Server Cross-site Scripting Vulnerability

    A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser

    SUSE apiserver github.com/rancher/apiserver Go
  • High 8.3
    CVE-2023-32193

    Norman API Cross-site Scripting Vulnerability

    A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

    SUSE norman github.com/rancher/norman Go
  • High 7.2
    CVE-2023-32194

    Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

    A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will receive * permissions for core namespaces. This can lead to someone being capable of accessing, creating…

    SUSE Rancher github.com/rancher/rancher Go

Revision history

  1. #1

    Initiale Fassung

References