Vulnerabilities

TI-2021-11979 CVE-2021-31999 · GHSA-pvxj-25m6-7vqr

Rancher: Privilege escalation vulnerability via malicious Connection header

MEDIUM 40

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01052 Published 2021-07-15 Fixed in 2.5.9, 2.4.16 CWE-807

TI-2021-07559 CVE-2021-25320 · GHSA-gqf8-rvrh-g7w6

Rancher: Cloud credentials can be used through proxy API by users without access

MEDIUM 44

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00855 Published 2021-07-15 Fixed in 2.5.9, 2.4.16 CWE-284

TI-2021-07557 CVE-2021-25318 · GHSA-f9xf-jq4j-vqw4

rancher: API group not properly specified when creating Kubernetes RBAC resources

MEDIUM 40

A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01051 Published 2021-07-15 Fixed in 2.5.9, 2.4.16 CWE-732

Vulnerabilities

Filters

Rancher: Privilege escalation vulnerability via malicious Connection header

Rancher: Cloud credentials can be used through proxy API by users without access

rancher: API group not properly specified when creating Kubernetes RBAC resources