CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-43759 – Rancher: Privilege escalation via promoted roles
https://notcve.org/view.php?id=CVE-2022-43759
07 Feb 2023 — A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10. • https://bugzilla.suse.com/show_bug.cgi?id=1205293 • CWE-269: Improper Privilege Management •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-21953 – Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
https://notcve.org/view.php?id=CVE-2022-21953
07 Feb 2023 — A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1. • https://bugzilla.suse.com/show_bug.cgi?id=1199731 • CWE-862: Missing Authorization •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 2CVE-2022-31247 – Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
https://notcve.org/view.php?id=CVE-2022-31247
07 Sep 2022 — An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16. Una vulnerabilidad de autori... • https://bugzilla.suse.com/show_bug.cgi?id=1199730 • CWE-285: Improper Authorization •
CVSS: 9.9EPSS: 81%CPEs: 2EXPL: 4CVE-2021-36782 – Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object
https://notcve.org/view.php?id=CVE-2021-36782
07 Sep 2022 — A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7. Una vulnerabilidad de Almacenamiento en Texto sin Cifrar de Información confidencial en SUSE Rancher permite a propietarios de clústeres, los miembros de clústere... • https://packetstorm.news/files/id/180695 • CWE-312: Cleartext Storage of Sensitive Information •