PT-2023-11445 · Rancher · Rancher

Macedogmpu · Published 2023-06-06 · Updated 2023-12-14 · CVE-2020-10676

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rancher versions 2.x through 2.6.12 Rancher versions 2.7.x through 2.7.3

Description An issue allows users with certain access to a namespace to move it to a different project, potentially gaining access to project-specific resources and causing availability issues due to quota limits. Users with roles such as Project Owner and Project Member on the source project, or custom roles with similar privileges, can exploit this. The issue is related to an incorrectly applied authorization check.

Recommendations For Rancher versions 2.x through 2.6.12, update to version 2.6.13 or later. For Rancher versions 2.7.x through 2.7.3, update to version 2.7.4 or later. As a temporary workaround, consider restricting access to namespace move operations to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-10676

GHSA-8VHC-HWHC-CPJ4

Affected Products

Rancher

References · 10

• https://osv.dev/vulnerability/GHSA-8vhc-hwhc-cpj4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10676 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10676 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/releases/tag/v2.7.4 · Note
• https://github.com/rancher/rancher/releases/tag/v2.6.13 · Note
• https://github.com/rancher/rancher/security/advisories/GHSA-8vhc-hwhc-cpj4 · Note
• https://forums.rancher.com/c/announcements · Note
• https://twitter.com/CVEnew/status/1734617269769216443 · Twitter Post
• https://github.com/advisories/GHSA-8vhc-hwhc-cpj4 · Note