PT-2023-18602 · Suse · Suse Rancher

Yvespp · Published 2023-06-01 · Updated 2026-03-03 · CVE-2023-22648

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions 2.6.7 through 2.6.12 SUSE Rancher versions 2.7.0 through 2.7.3

Description The issue is related to improper privilege management, where changes in Azure AD permissions are not reflected in the Rancher UI for logged-in users. This means users retain their previous permissions, even if their group membership changes in Azure AD, such as being moved to a lower-privileged group or being removed from a group. As a result, users retain access to Rancher instead of losing it.

Recommendations For SUSE Rancher versions 2.6.7 through 2.6.12, update to version 2.6.13 or later. For SUSE Rancher versions 2.7.0 through 2.7.3, update to version 2.7.4 or later.

Fix

Session Fixation

Improper Privilege Management

Weakness Enumeration

CWE-384

CWE-271

CWE-269

Related Identifiers

CVE-2023-22648

GHSA-VF6J-6739-78M8

Affected Products

Suse Rancher

References · 6

• https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vf6j-6739-78m8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22648 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648 · Vendor Advisory
• https://github.com/rancher/rancher · Note