CVE-2021-25320

Published: Jul 15, 2021Modified: Nov 21, 2024

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: NVD

Description

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16.

Affected (2)

Products: Rancher: Rancher

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Rancher Rancher	Before 2.4.16
Rancher Rancher	From 2.5.0 to 2.5.9

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=1185514

Source: meissner@suse.de

Issue TrackingThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1185514

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.