What is CVE-2019-12274?

CVE-2019-12274 is a high-severity vulnerability in Suse Rancher, classified under Exposure of Resource to Wrong Sphere. CVSS score: 8.8/10. Published 2019-06-06.

How severe is CVE-2019-12274?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Suse Rancher

CVE-2019-12274

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.

EPSS: 0.011 (63.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Suse Rancher
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2019-12274?: CVE-2019-12274 is a high-severity vulnerability in Suse Rancher, classified under Exposure of Resource to Wrong Sphere. CVSS score: 8.8/10. Published 2019-06-06.
How severe is CVE-2019-12274?: High severity. CVSS v3 base score is 8.8 out of 10.