CVE-2023-22650

high

Description

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

References

https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2002

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650

Details

Source: Mitre, NVD

Published: 2024-10-16

Updated: 2026-04-15

Named Vulnerability: GO-2024-2931Named Vulnerability: GHSA-9ghh-mmcq-8phc

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00607