CVE-2023-22650 — Improper Authentication in Rancher

CWE-287 — Improper AuthenticationCWE-306 — Missing Authentication for Critical FunctionCWE-613 — Insufficient Session Expiration5 documents4 sources
Severity
8.7HIGHNVD
EPSS
0.2%
top 63.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Suse RancherGithub.com Rancher Rancher
Timeline
PublishedOct 16

Description

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5suse/rancher2.7.0 — 2.7.14+1
▶Gogithub.com/rancher_rancher2.7.0 — 2.7.14+1

🔴Vulnerability Details

4
CVEList
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider↗2024-10-16
▶
OSV
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher↗2024-06-28
▶
GHSA
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider↗2024-06-17
▶
OSV
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider↗2024-06-17
▶
CVE-2023-22650 — Improper Authentication in Rancher | cvebase