DeutschShown in its original language — a full translation is planned for a future version.
Rancher: Mehrere Schwachstellen
view advisory published 2023-01-24
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuführen.
01
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-43759US | high8.8 | — | ||
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any clus… | ||||
| CVE-2022-43758US | medium6.8 | — | ||
A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an… | ||||
| CVE-2022-43757US | high8.8OT elevated | — | ||
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exp… | ||||
| CVE-2022-43755US | critical9.8OT elevated | — | ||
A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issu… | ||||
| CVE-2022-21953US | high8.8OT elevated | — | ||
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: S… | ||||
02
references
External citations — patches, advisories, analysis.
- GitHub Advisory Database vom 2023-01-24external
- GitHub Advisory Database vom 2023-01-24external
- GitHub Advisory Database vom 2023-01-24external
- GitHub Advisory Database vom 2023-01-24external
- GitHub Advisory Database vom 2023-01-24external
- GitHub Advisory Database vom 2023-01-24external
- WID-SEC-W-2023-0197 - CSAF Versionself
- WID-SEC-2023-0197 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan