CVE-2022-31247: suse rancher Improper Authorization
Vulnerability summary
CVE-2022-31247 is a critical (CVSS 9.1) Improper Authorization vulnerability in suse rancher. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 07-09-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An Improper Authorization vulnerability in SUSE Rancher, allows any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.6.7; Rancher versions prior to 2.5.16.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.98%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
+0.02 pp
From 0.96% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundRancher
Maturity: poc
Exploit Reference (bugzilla.suse.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Github.com/rancher1 product
- rancher≥ 2.5.0, < 2.5.16 | ≥ 2.6.0, < 2.6.7
Suse1 product
- rancher≥ Rancher, < 2.6.7 | ≥ Rancher, < 2.5.16 | ≥ 2.5.0, < 2.5.16 | ≥ 2.6.0, < 2.6.7
2 vendors · 2 products
References
4 links- bugzilla.suse.com/show_bug.cgi?id=1199730X Refsource CONFIRMWEBExploitIssue TrackingMitigationVendor Advisory
- github.com/rancher/rancher/security/advisories/GHSA-6x34-89p7-95wgX Refsource CONFIRMWEBExploitMitigationThird Party Advisory
- github.com/rancher/rancherPACKAGE