CVE-2021-25320

Aliases:GHSA-gqf8-rvrh-g7w6GO-2026-4589CGA-3j8p-fv87-qmh6CGA-55x8-68m7-vrf7CGA-6g33-qr74-q78gCGA-8f4r-hw6j-vxw4CGA-f9cw-p595-pgfvCGA-jfcg-x7wj-p5hhCGA-jj8h-x7r2-9xg6CGA-xr9v-689w-pjjr
Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 15 Jul 2021, 08:55
Last modified:16 Sept 2024, 20:21

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.9 CRITICAL
v3.1 (cve.org)
EPSS Score
0.85% LOW
1% probability +0.65%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Jul 2021, 08:55
Published
Vulnerability first disclosed
16 Sept 2024, 20:21
Last Modified
Vulnerability information updated

Description

A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.85%• Percentile: 57%

Techniques & Countermeasures

  • CWE-284•Improper Access Control

    The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected Systems

  • chainguard•harvester

    < 0

  • chainguard•harvester-fips

    < 0

  • chainguard•harvester-fips-webhook

    < 0

  • chainguard•harvester-webhook

    < 0

  • github.com/rancher•rancher

    ≥ 2.2.0+incompatible | ≥ 2.2.0, < 2.4.16 | ≥ 2.5.0, < 2.5.9

  • rancher•rancher

    ≥ Rancher, < 2.5.9 | ≥ Rancher, < 2.4.16 | < 2.4.16 | ≥ 2.5.0, < 2.5.9

References (4)