CVE-2023-22650CWE-287

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

High · published October 16, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00607 · 48.4th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-10-16T08:20Z
EPSS history
Timeline
  • 16 OCT 08:20Z
    Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
    cvelistv5