CVE-2019-12274 - In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud

Back Back to CVE browser

HIGH

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud

Published Jun 6, 2019

8.8

HIGH

CVSS 3.0

EPSS 1.12%

Description

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

Affected products

github.com/rancher/rancher

Go

Introduced 0 Fixed 1.6.27
github.com/rancher/rancher

Go

Introduced 2.0.0+incompatible Fixed 2.2.4+incompatible

Ecosystem	Package	Introduced	Fixed
Go	github.com/rancher/rancher	0	1.6.27
Go	github.com/rancher/rancher	2.0.0+incompatible	2.2.4+incompatible

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-668

CWE-862

Missing Authorization

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3935
Advisory
https://forums.rancher.com/c/announcements
x_refsource_CONFIRMRelease NotesVendor Advisory
https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466
x_refsource_CONFIRMRelease NotesVendor Advisory
https://github.com/advisories/GHSA-gc62-j469-9gjm
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-12274

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3935		Advisory
https://forums.rancher.com/c/announcements		x_refsource_CONFIRMRelease NotesVendor Advisory
https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466		x_refsource_CONFIRMRelease NotesVendor Advisory
https://github.com/advisories/GHSA-gc62-j469-9gjm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-12274