CVE-2023-22650
Last modified
CVE-2023-22650 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.. EPSS estimates a 0.58% chance of exploitation in the next 30 days.
Description
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-22650?
How severe is CVE-2023-22650?
How do I fix CVE-2023-22650?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-22644A user can reverse engineer the JWT token (JSON Web Token) u…5.5
- CVE-2023-22645An Improper Privilege Management vulnerability in SUSE kubew…8.8
- CVE-2023-22647An Improper Privilege Management vulnerability in SUSE Ranch…8
- CVE-2023-22648A Improper Privilege Management vulnerability in SUSE Ranche…8.8
- CVE-2023-22649A vulnerability has been identified which may lead to sensit…6.5
- CVE-2023-2265An Improper Restriction of Rendered UI Layers or Frames in t…6.1
- CVE-2023-22651Improper Privilege Management vulnerability in SUSE Rancher …9.9
- CVE-2023-22652A Buffer Copy without Checking Size of Input ('Classic Buffe…6.5
- CVE-2023-22653An OS command injection vulnerability exists in the vtysh_ub…8.8
- CVE-2023-22654Client-side enforcement of server-side security issue exists…5.4
- CVE-2023-22655Protection mechanism failure in some 3rd and 4th Generation …6.1
- CVE-2023-22656Out-of-bounds read in Intel(R) Media SDK and some Intel(R) o…3.9
Are you affected by CVE-2023-22650?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST