Upstream information

CVE-2023-22649 at MITRE

Description

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels) set to `1 or above` are impacted by this issue.

Upstream Security Advisories:

SUSE information

Overall state of this security issue: Pending

This issue is currently rated as having important severity.

CVSS v3 Scores
  CNA (SUSE) National Vulnerability Database SUSE
Base Score 8.4 6.5 7.7
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Attack Vector Network Network Local
Attack Complexity Low Low Low
Privileges Required High None High
User Interaction Required Required Required
Scope Changed Unchanged Changed
Confidentiality Impact High High High
Integrity Impact High None High
Availability Impact High None High
CVSSv3 Version 3.1 3.1 3.1
CVSS v4 Scores
  CNA (SUSE)
Base Score 8.4
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Attack Requirements None
Privileges Required High
User Interaction Passive
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact High
Subsequent System Integrity Impact High
Subsequent System Availability Impact High
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1210529 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE Timeline for this CVE

CVE page created: Mon Apr 17 15:00:07 2023
CVE page last modified: Mon Nov 18 14:11:36 2024