Auth bypass in SUSE Rancher
CVE-2019-11202
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
Vulnerability class: Broken Authentication
EPSS: 0.016 (74.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Suse Rancher
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11202?
- CVE-2019-11202 is a critical-severity vulnerability in SUSE Rancher, classified under Improper Authentication. CVSS score: 9.8/10. Published 2019-07-30.
- How severe is CVE-2019-11202?
- Critical severity. CVSS v3 base score is 9.8 out of 10.