CVE-2023-22650

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-22650
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22650.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-22650
Aliases
Related
Published
2024-10-16T08:20:42.467Z
Modified
2026-08-08T03:30:49.962057969Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
Details

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

Database specific 
{
    "cna_assigner": "suse",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22650.json",
    "cwe_ids": [
        "CWE-287"
    ]
}
References

Affected packages

Git / github.com/rancher/rancher

Affected ranges

Type
GIT
Repo
https://github.com/rancher/rancher
Events
Introduced
ce9a7aea4b13fed7acd02cc32667b2ae72f98f5a
Fixed
ae8fa4989d171c6081cd5addb9d058fb0f57eedd
Introduced
72f58378bf03122a9651c9bd3b4c143a57e8fdaa
Fixed
7af1354e9b8900cec6e5360787e291acd376e6d3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.14"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "2.8.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.7.0
v2.7.0-novkdm
v2.7.12
v2.7.12-alpha1
v2.7.12-alpha2
v2.7.12-rc1
v2.7.12-rc2
v2.7.12-rc3
v2.7.13
v2.7.13-alpha1
v2.7.13-rc1
v2.7.13-rc2
v2.7.13-rc3
v2.7.13-rc4
v2.7.13-rc5
v2.7.14-rc1
v2.7.14-rc2
v2.7.2
v2.7.2-rc1
v2.7.2-rc10
v2.7.2-rc2
v2.7.2-rc3
v2.7.2-rc4
v2.7.2-rc5
v2.7.2-rc6
v2.7.2-rc7
v2.7.2-rc8
v2.7.2-rc9
v2.7.5
v2.7.5-rc1
v2.7.5-rc2
v2.7.5-rc3
v2.7.5-rc4
v2.7.5-rc5
v2.7.5-rc6
v2.7.7
v2.7.7-rc1
v2.7.7-rc2
v2.7.7-rc3
v2.7.7-rc4
v2.7.7-rc5
v2.7.7-rc6
v2.7.7-rc7
v2.7.8
v2.7.8-rc1
v2.8.0
v2.8.0-rc5
v2.8.3
v2.8.3-alpha1
v2.8.3-alpha2
v2.8.3-rc1
v2.8.3-rc2
v2.8.3-rc3
v2.8.3-rc4
v2.8.3-rc5
v2.8.3-rc6
v2.8.3-rc7
v2.8.3-rc8
v2.8.4
v2.8.4-alpha1
v2.8.4-rc1
v2.8.4-rc2
v2.8.4-rc3
v2.8.4-rc4
v2.8.4-rc5
v2.8.5-rc1
v2.8.5-rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22650.json"