Code injection

2017-03-2900:59:00

PRIOn knowledge base

www.prio-n.com

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.0%

JSON

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

CPENameOperatorVersion
rancherge1.4.0
rancherlt1.4.3
rancherge1.5.0
rancherlt1.5.3
rancherge1.3.0
rancherlt1.3.5
rancherge1.2.0
rancherlt1.2.4

Name	Operator	Version
rancher	ge	1.4.0
rancher	lt	1.4.3
rancher	ge	1.5.0
rancher	lt	1.5.3
rancher	ge	1.3.0
rancher	lt	1.3.5
rancher	ge	1.2.0
rancher	lt	1.2.4

References

www.securityfocus.com/bid/97180

github.com/rancher/rancher/issues/8296