HIGH
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher
Published Sep 4, 2019
8.7
HIGHCVSS 3.1
EPSS 1.10%
Description
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.
Affected products
No data.
No data.
No Red Hat product state for this CVE.
github.com/rancher/rancher
Go
Introduced 0 Fixed 2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatible
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/rancher/rancher | 0 | 2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatible |
Remediation
No remediation recorded yet.
Weaknesses (2)
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1233 Advisory
- https://forums.rancher.com/c/announcements x_refsource_MISCRelease NotesVendor Advisory
- https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801 x_refsource_CONFIRMRelease NotesVendor Advisory
- https://github.com/advisories/GHSA-xhg2-rvm8-w2jh Advisory
- https://github.com/rancher/rancher/commit/0ddffe484adccb9e37d9432e8e625d8ebbfb0088
- https://nvd.nist.gov/vuln/detail/CVE-2019-13209
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1233 | Advisory | |
| https://forums.rancher.com/c/announcements | x_refsource_MISCRelease NotesVendor Advisory | |
| https://forums.rancher.com/t/rancher-release-v2-2-5-addresses-rancher-cve-2019-13209/14801 | x_refsource_CONFIRMRelease NotesVendor Advisory | |
| https://github.com/advisories/GHSA-xhg2-rvm8-w2jh | Advisory | |
| https://github.com/rancher/rancher/commit/0ddffe484adccb9e37d9432e8e625d8ebbfb0088 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2019-13209 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 4, 2019
Updated Aug 4, 2024
Reserved Jul 3, 2019
Link CVE-2019-13209
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2021-1233 GHSA-XHG2-RVM8-W2JH Assigner mitre
Published Sep 4, 2019
Updated Aug 4, 2024
Exploited since n/a
Link EUVD-2021-1233