CVE-2023-22647
First published: Thu Jun 01 2023(Updated: )
An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the local cluster. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
Credit: meissner@suse.de meissner@suse.de meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/rancher/rancher | >=2.7.0<2.7.4 | 2.7.4 |
| go/rancher/rancher | >=2.6.0<2.6.13 | 2.6.13 |
| SUSE Rancher | >=2.6.0<2.6.13 | |
| SUSE Rancher | >=2.7.0<2.7.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/rancher/rancher/security/advisories/GHSA-p976-h52c-26p6
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22647
- https://nvd.nist.gov/vuln/detail/CVE-2023-22647
- https://github.com/rancher/rancher/releases/tag/v2.6.13
- https://github.com/rancher/rancher/releases/tag/v2.7.4
- https://github.com/advisories/GHSA-p976-h52c-26p6 (Advisory)
Frequently Asked Questions
What is the impact of CVE-2023-22647?
The vulnerability allows standard users or above to elevate their permissions and perform actions they should not be able to.
What software is affected by CVE-2023-22647?
SUSE Rancher versions 2.6.0 through 2.6.13 and 2.7.0 through 2.7.4 are affected.
How can I fix CVE-2023-22647?
Upgrade to SUSE Rancher version 2.7.4 if you are using version 2.7.0 through 2.7.3, or upgrade to version 2.6.13 if you are using version 2.6.0 through 2.6.12.
What is the severity of CVE-2023-22647?
The severity of CVE-2023-22647 is critical, with a CVSS score of 9.9.
What is the Common Weakness Enumeration (CWE) ID for CVE-2023-22647?
The CWE ID for CVE-2023-22647 is CWE-269.
- collector/nvd-latest
- collector/github-advisory-latest
- alias/GHSA-p976-h52c-26p6
- alias/CVE-2023-22647
- collector/nvd-api
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/tags
- agent/event
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- package-manager/go
- vendor/suse
- canonical/suse rancher
- version/suse rancher/2.6.0
- version/suse rancher/2.7.0