TI-2021-14897 CVE-2021-36776 · GHSA-gvh9-xgrq-r8hw
Steve API proxy impersonation
Priority MEDIUM 40
A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users.
Vulnerabilities
5 records
TI-2021-14896 CVE-2021-36775 · GHSA-28g7-896h-695v
Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings
Priority MEDIUM 40
a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked.
TI-2021-11979 CVE-2021-31999 · GHSA-pvxj-25m6-7vqr
Rancher: Privilege escalation vulnerability via malicious Connection header
Priority MEDIUM 40
A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers.
TI-2021-07559 CVE-2021-25320 · GHSA-gqf8-rvrh-g7w6
Rancher: Cloud credentials can be used through proxy API by users without access
Priority MEDIUM 44
A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID.
TI-2021-07557 CVE-2021-25318 · GHSA-f9xf-jq4j-vqw4
rancher: API group not properly specified when creating Kubernetes RBAC resources
Priority MEDIUM 40
A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to.