CVE-2023-22648

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22648

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 Issue Tracking Vendor Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 Issue Tracking Vendor Advisory
https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:45

Type Values Removed Values Added
References () https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 - Issue Tracking, Vendor Advisory () https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 - Issue Tracking, Vendor Advisory
References () https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - Vendor Advisory () https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 - Vendor Advisory
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 8.0

09 Oct 2024, 09:15

Type Values Removed Values Added
CWE CWE-269 CWE-271
Summary (en) A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4. (en) A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Information

Published : 2023-06-01 13:15

Updated : 2024-11-21 07:45

NVD link : CVE-2023-22648

Mitre link : CVE-2023-22648

CVE.ORG link : CVE-2023-22648

JSON object : View

Products Affected

suse

CWE
CWE-271

Privilege Dropping / Lowering Errors

NVD-CWE-Other