CVE-2022-21953

Published: Feb 7, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Affected (3)

Products: Suse: Rancher

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Suse Rancher	From 2.5.0 to 2.5.17
Suse Rancher	From 2.6.0 to 2.6.10
Suse Rancher	From 2.7.0 to 2.7.1

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=1199731

Source: meissner@suse.de

Issue Tracking

https://bugzilla.suse.com/show_bug.cgi?id=1199731

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

Timeline

No history available yet.