CVE-2019-6287
HIGH8.1EPSS 0.17%Rancher Project Members Have Continued Access to Namespaces After Being Removed From Them
Published: 5/13/2022Modified: 6/5/2024
Description
In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it.
Affected packages (2)
- Go/github.com/rancher/rancher>= 2.0.0, < 2.1.6
- Go/github.com/rancher/rancher>= 2.0.0+incompatible, < 2.1.6+incompatible
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
References (8)
- ADVISORYhttps://github.com/advisories/GHSA-6r7x-4q7g-h83j
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-6287
- PATCHhttps://github.com/rancher/rancher
- WEBhttps://forums.rancher.com/t/rancher-release-v2-1-6/13148
- WEBhttps://forums.rancher.com/t/rancher-security-announcement-cve-2018-20321-and-cve-2019-6287/13149
- WEBhttps://github.com/rancher/rancher/issues/17244
- WEBhttps://github.com/rancher/rancher/issues/17724
- WEBhttps://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11