VULNERABILITY INTELLIGENCE

CVE-2022-31247

CVSS score9.1 CRITICAL

EPSS probability1.00%

CISA KEVNot currently listed

Published2022-09-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.

Weakness classification

meissner@suse.de: CWE-285
nvd@nist.gov: NVD-CWE-Other

Primary references

meissner@suse.de — Exploit, Issue Tracking, Mitigation, Vendor Advisory
meissner@suse.de — Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory