Vulnerability Details : CVE-2023-22648
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users
while they are logged in the Rancher UI. This would cause the users to
retain their previous permissions in Rancher, even if they change groups
on Azure AD, for example, to a lower privileged group, or are removed
from a group, thus retaining their access to Rancher instead of losing
it.
This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Products affected by CVE-2023-22648
- cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
- cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-22648
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-22648
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.0
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
2.1
|
5.9
|
SUSE | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-22648
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: meissner@suse.de (Secondary)
-
The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.Assigned by: meissner@suse.de (Primary)
-
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-22648
-
https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8
Azure AD permission changes are not reflected on active sessions · Advisory · rancher/rancher · GitHubVendor Advisory
-
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648
1210528 – (CVE-2023-22648) VUL-0: CVE-2023-22648: Rancher: Automatically Refreshing User Information not working properly externalIssue Tracking;Vendor Advisory
Jump to