Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' through the impersonation middleware in pkg/auth/requests/sar/middleware.go and the SAR wiring in pkg/multiclustermanager/routes.go. An authenticated user can gain administrative access...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' through the impersonation middleware in pkg/auth/requests/sar/middleware.go and the SAR wiring in pkg/multiclustermanager/routes.go. An authenticated user can gain administrative access...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview github.com/rancher/rancher/pkg/clusterrouter is a project that provides a container management platform built for organizations that deploy containers in production Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' through the...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' through the impersonation middleware in pkg/auth/requests/sar/middleware.go and the SAR wiring in pkg/multiclustermanager/routes.go. An authenticated user can gain administrative access...

PT-2022-13085 · Unknown · Bored-Agent

Name of the Vulnerable Software and Affected Versions: bored-agent versions prior to 0.6.1 Description: The issue arises from the failure to sanitize incoming Kubernetes impersonation headers, allowing a user to override the assigned user name and groups. Recommendations: For versions prior to...

CVE-2022-0270: Improper Access Control

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups...

CVE-2021-31999

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16...