Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2022-31247

Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE Rancher

  • Rancher to < 2.6.7affected

SUSE Rancher

  • Rancher to < 2.5.16affected

References