Riskcovery

CVE-2023-22651

State
Published
Severity
9.9 Critical
Published
May 4, 2023
Updated
Jan 29, 2025
Reserved
Jan 5, 2023

Read the record on cve.org

Description

Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster. The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.

Scores

CVSSScoreVectorSource
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsuse
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-269 Improper Privilege Management
  • CWE-276 Incorrect Default Permissions

Affected Products

ProductVersions
RancherSUSE
  • 2.6.0 through 2.7.2Affected
  • 2.7.3Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.