PT-2019-18075 · Rancher · Rancher

Published 2019-04-10 · Updated 2024-06-05 · CVE-2019-6287

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rancher versions 2.0.0 through 2.1.5

Description The issue allows project members to continue accessing and managing namespaces within a project even after they have been removed from it. This means they can still create, update, read, and delete namespaces.

Recommendations For Rancher versions 2.0.0 through 2.1.5, consider restricting access to namespace management features for removed project members as a temporary workaround until a patch is available.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2019-6287

GHSA-6R7X-4Q7G-H83J

GO-2024-2764

Affected Products

Rancher

References · 12

• https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11 · Vendor Advisory
• https://forums.rancher.com/c/announcements · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6287 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2764 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6r7x-4q7g-h83j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6287 · Security Note
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/issues/17724 · Note
• https://github.com/rancher/rancher/issues/17244 · Note
• https://forums.rancher.com/t/rancher-release-v2-1-6/13148 · Note
• https://github.com/advisories/GHSA-6r7x-4q7g-h83j · Note
• https://forums.rancher.com/t/rancher-security-announcement-cve-2018-20321-and-cve-2019-6287/13149 · Note