CVE-2018-20321 — Resource Exposure in Rancher Rancher

CWE-668 — Resource ExposureCWE-288 — Authentication Bypass Using an Alternate Path or Channel5 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 36.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Rancher RancherSuse Rancher
Timeline
PublishedApr 10
Latest updateAug 21

Description

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this bug affected ALL clusters created or imported by Rancher.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶Gogithub.com/rancher_rancher2.0.0 — 2.1.6+1
▶NVDsuse/rancher2.0.0 — 2.1.5

🔴Vulnerability Details

4
OSV
Access Control Bypass in github.com/rancher/rancher↗2024-08-21
▶
OSV
Access Control Bypass↗2021-06-23
▶
GHSA
Access Control Bypass↗2021-06-23
▶
CVEList
CVE-2018-20321: An issue was discovered in Rancher 2 through 2↗2019-04-10
▶
CVE-2018-20321 — Resource Exposure in Rancher Rancher | cvebase