CVE-2023-22651

moderate-risk
Published 2023-05-04

Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks before resources are admitted into the Kubernetes cluster. The issue only affects users that upgrade from 2.6.x or 2.7.x to 2.7.2. Users that did a fresh install of 2.7.2 (and did not follow an upgrade path) are not affected.

Do I need to act?

-
0.39% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.9/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Suse

References (4)

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651
Mitigation https://github.com/rancher/rancher/security/advisories/GHSA-6m9f-pj6w-w87g
Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22651
Mitigation https://github.com/rancher/rancher/security/advisories/GHSA-6m9f-pj6w-w87g
39
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal