Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2024-58260

Rancher update on users can deny the service to the admin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
suse

Description

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SUSE rancher

Default version status: unaffected

  • 2.12.0 to < 2.12.2affected
  • 2.11.0 to < 2.11.6affected
  • 2.10.0 to < 2.10.10affected
  • 2.9.0 to < 2.9.12affected

References