PT-2023-11445 · Rancher · Rancher

Macedogmpu · Publicado 2023-06-06 · Atualizado 2023-12-14 · CVE-2020-10676

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2.x through 2.6.12 Rancher versions 2.7.x through 2.7.3

Description An issue allows users with certain access to a namespace to move it to a different project, potentially gaining access to project-specific resources and causing availability issues due to quota limits. Users with roles such as Project Owner and Project Member on the source project, or custom roles with similar privileges, can exploit this. The issue is related to an incorrectly applied authorization check.

Recommendations For Rancher versions 2.x through 2.6.12, update to version 2.6.13 or later. For Rancher versions 2.7.x through 2.7.3, update to version 2.7.4 or later. As a temporary workaround, consider restricting access to namespace move operations to minimize the risk of exploitation.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2020-10676

GHSA-8VHC-HWHC-CPJ4

Produtos afetados

Rancher

Referências · 10

• https://github.com/rancher/rancher · Nota
• https://github.com/rancher/rancher/releases/tag/v2.7.4 · Nota
• https://github.com/rancher/rancher/releases/tag/v2.6.13 · Nota
• https://github.com/rancher/rancher/security/advisories/GHSA-8vhc-hwhc-cpj4 · Nota
• https://forums.rancher.com/c/announcements · Nota
• https://osv.dev/vulnerability/GHSA-8vhc-hwhc-cpj4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-10676 · Nota de Segurança
• https://twitter.com/CVEnew/status/1734617269769216443 · Publicação no Twitter
• https://github.com/advisories/GHSA-8vhc-hwhc-cpj4 · Nota
• https://osv.dev/vulnerability/CVE-2020-10676 · Aviso do Fabricante