PT-2019-12180 · Rancher · Rancher

Published 2019-07-30 · Updated 2024-06-10 · CVE-2019-11202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2.0.0 through 2.0.13 Rancher versions 2.1.0 through 2.1.8 Rancher versions 2.2.0 through 2.2.1

Description An issue affects Rancher where a default admin user is created with a well-known password when it starts for the first time. Even if the default admin user is deleted after initial setup, restarting Rancher will recreate this user with the same default password. This allows an attacker to exploit the system by logging in with the default admin credentials.

Recommendations For versions 2.0.0 through 2.0.13, deactivate the default admin user instead of deleting it to mitigate the issue. For versions 2.1.0 through 2.1.8, deactivate the default admin user instead of deleting it to mitigate the issue. For versions 2.2.0 through 2.2.1, deactivate the default admin user instead of deleting it to mitigate the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-11202

GHSA-XH8X-J8H3-M5PH

GO-2024-2784

Affected Products

Rancher

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2019-11202 · Security Note
• https://rancher.com/docs/rancher/v2.x/en/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11202 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xh8x-j8h3-m5ph · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2784 · Vendor Advisory
• https://forums.rancher.com/c/announcements · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://pkg.go.dev/vuln/GO-2024-2784 · Note
• https://github.com/advisories/GHSA-xh8x-j8h3-m5ph · Note
• https://forums.rancher.com/t/rancher-release-v2-2-2-addresses-rancher-cve-2019-11202-and-stability-issues/13977 · Note