PT-2019-12180 · Rancher · Rancher

Publicado 2019-07-30 · Atualizado 2024-06-10 · CVE-2019-11202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2.0.0 through 2.0.13 Rancher versions 2.1.0 through 2.1.8 Rancher versions 2.2.0 through 2.2.1

Description An issue affects Rancher where a default admin user is created with a well-known password when it starts for the first time. Even if the default admin user is deleted after initial setup, restarting Rancher will recreate this user with the same default password. This allows an attacker to exploit the system by logging in with the default admin credentials.

Recommendations For versions 2.0.0 through 2.0.13, deactivate the default admin user instead of deleting it to mitigate the issue. For versions 2.1.0 through 2.1.8, deactivate the default admin user instead of deleting it to mitigate the issue. For versions 2.2.0 through 2.2.1, deactivate the default admin user instead of deleting it to mitigate the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2019-11202

GHSA-XH8X-J8H3-M5PH

GO-2024-2784

Produtos afetados

Rancher

Referências · 10

• https://github.com/rancher/rancher · Nota
• https://pkg.go.dev/vuln/GO-2024-2784 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11202 · Nota de Segurança
• https://rancher.com/docs/rancher/v2.x/en/security · Aviso do Fabricante
• https://github.com/advisories/GHSA-xh8x-j8h3-m5ph · Nota
• https://osv.dev/vulnerability/CVE-2019-11202 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xh8x-j8h3-m5ph · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2024-2784 · Aviso do Fabricante
• https://forums.rancher.com/c/announcements · Aviso do Fabricante
• https://forums.rancher.com/t/rancher-release-v2-2-2-addresses-rancher-cve-2019-11202-and-stability-issues/13977 · Nota