CVE-2023-22648

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22648
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 Issue Tracking Vendor Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
History

09 Oct 2024, 09:15

Type Values Removed Values Added
Summary (en) A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4. (en) A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
CWE CWE-269 CWE-271

09 Jun 2023, 17:23

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-269 CWE-384
CPE cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
References (MISC) https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - (MISC) https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - Vendor Advisory
References (MISC) https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 - (MISC) https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 - Issue Tracking, Vendor Advisory

01 Jun 2023, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-01 13:15

Updated : 2024-10-09 09:15

NVD link : CVE-2023-22648

Mitre link : CVE-2023-22648

CVE.ORG link : CVE-2023-22648

JSON object : View

Products Affected

suse

  • rancher
CWE
CWE-271

Privilege Dropping / Lowering Errors

NVD-CWE-Other