CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.

CVSS v3 8.8 HIGH
CVSS v2.0 5.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 6.5 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=1197491	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:suse:rancher_desktop:*:*:*:*:*:*:*:*

History

06 Jul 2023, 15:15

Type	Values Removed	Values Added
Summary	A Improper Access Control vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.	A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.

27 Jun 2023, 19:01

Type	Values Removed	Values Added
CWE	~~CWE-284~~	CWE-668

11 Apr 2022, 19:16

Type	Values Removed	Values Added
CPE		cpe:2.3:a:suse:rancher_desktop::::::::
References	~~(CONFIRM) https://bugzilla.suse.com/show_bug.cgi?id=1197491 -~~	(CONFIRM) https://bugzilla.suse.com/show_bug.cgi?id=1197491 - Issue Tracking, Third Party Advisory
First Time		Suse rancher Desktop Suse
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 5.8 v3 : 8.8

01 Apr 2022, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-04-01 07:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-21947

Mitre link : CVE-2022-21947

CVE.ORG link : CVE-2022-21947

JSON object : View

Products Affected

suse

rancher_desktop

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2022-21947", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2022-04-01T07:15:07.407", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1197491", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "meissner@suse.de"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inapropiado en Rancher Desktop de SUSE permite a atacantes de la red local conectarse a la API de Dashboard (steve) para llevar a cabo acciones arbitrarias. Este problema afecta a: SUSE Rancher Desktop versiones anteriores a V"}], "lastModified": "2023-07-06T15:15:10.207", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:rancher_desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E9E4E67-6120-4B53-A315-3BA28F093BBE", "versionEndExcluding": "1.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "meissner@suse.de"}