CVE-2023-32199: fallo de gravedad media en SUSE rancher
Rancher user retains access to clusters despite Global Role removal
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.2%
probabilidad de explotación
0.2%top 87% de las CVE
explotación observada
noninguna fuente lo reporta
A vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Productos afectados
SUSE · rancherCVEs relacionadas — SUSE rancher
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-22649HIGHRancher 'Audit Log' leaks sensitive informationEPSS 2.0%CVE-2024-22036CRITICALRancher Remote Code Execution via Cluster/Node DriversEPSS 0.8%CVE-2023-32197HIGHRancher's External RoleTemplates can lead to privilege escalationEPSS 0.6%CVE-2023-22650HIGHRancher does not automatically clean up a user deleted or disabled from the configured Authentication ProviderEPSS 0.6%CVE-2025-23388HIGHUnauthenticated stack overflow in /v3-public/authproviders APIEPSS 0.6%CVE-2025-23387MEDIUMRancher's SAML-based login via CLI can be denied by unauthenticated usersEPSS 0.6%