CVE-2023-22650

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

State: Published
Severity: 8.7 High
Published: Oct 16, 2024
Updated: Oct 16, 2024
Reserved: Jan 5, 2023

Description

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	suse
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	suse

Weaknesses

CWE-287 Improper Authentication
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
rancherSUSE	2.7.0 to before 2.7.14Affected 2.8.0 to before 2.8.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.