CVE-2021-31999

CVE-2021-31999, security advisory, suse linux, suse, security, cve

CVE-2021-31999

Common Vulnerabilities and Exposures

[Previous] [Index] [Next]

Upstream information

CVE-2021-31999 at MITRE

Description

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	6.5
Vector	AV:N/AC:L/Au:S/C:P/I:P/A:P
Access Vector	Network
Access Complexity	Low
Authentication	Single
Confidentiality Impact	Partial
Integrity Impact	Partial
Availability Impact	Partial

CVSS v3 Scores

	National Vulnerability Database	SUSE
Base Score	8.8	8.8
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Network	Network
Attack Complexity	Low	Low
Privileges Required	Low	Low
User Interaction	None	None
Scope	Unchanged	Unchanged
Confidentiality Impact	High	High
Integrity Impact	High	High
Availability Impact	High	High
CVSSv3 Version	3.1	3.1

SUSE Bugzilla entry: 1187084 [RESOLVED / FIXED]

SUSE Security Advisories:

• GHSA-pvxj-25m6-7vqr, published Fri Jul 23 16:55:24 CEST 2021
• RANCHER-CVE-2021-31999, published Thu Jul 15 09:21:00 CEST 2021

---

SUSE Timeline for this CVE

CVE page created: Wed Jun 9 01:40:35 2021
CVE page last modified: Wed Oct 26 23:16:01 2022