Rancher Access Control Vulnerability

2022-05-1301:02:31

Google

osv.dev

0.001 Low

EPSS

Percentile

40.0%

JSON

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

CPENameOperatorVersion
github.com/rancher/rancherge1.2.0
github.com/rancher/rancherge1.4.0
github.com/rancher/rancherlt1.3.5
github.com/rancher/rancherge1.3.0
github.com/rancher/rancherlt1.4.3
github.com/rancher/rancherlt1.2.4
github.com/rancher/rancherge1.5.0
github.com/rancher/rancherlt1.5.3

Name	Operator	Version
github.com/rancher/rancher	ge	1.2.0
github.com/rancher/rancher	ge	1.4.0
github.com/rancher/rancher	lt	1.3.5
github.com/rancher/rancher	ge	1.3.0
github.com/rancher/rancher	lt	1.4.3
github.com/rancher/rancher	lt	1.2.4
github.com/rancher/rancher	ge	1.5.0
github.com/rancher/rancher	lt	1.5.3