« Volver al listado

CVE-2021-31999

Estado: ModificadaAlta (8.8)—

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rancher — Rancher

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-31999",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "Rancher",
          "product": "Rancher",
          "versions": [
            {
              "status": "affected",
              "version": "Rancher",
              "lessThan": "2.5.9",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Rancher",
          "product": "SUSE Linux Enterprise Server 15",
          "versions": [
            {
              "status": "affected",
              "version": "Rancher",
              "lessThan": "2.4.16",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-15T09:15:08.210",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1187084",
      "tags": [
        "Issue Tracking",
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1187084",
      "tags": [
        "Issue Tracking",
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-807"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the \"Impersonate-User\" or \"Impersonate-Group\" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Dependencia de Datos no Confiables en una Decisión de Seguridad en Rancher permite a usuarios del cluster actuar como otros usuarios del cluster al falsificar los encabezados \"Impersonate-User\" o \"Impersonate-Group\". Este problema afecta a: Rancher versiones anteriores a 2.5.9. Rancher versiones anteriores a 2.4.16"
    }
  ],
  "lastModified": "2026-06-17T03:52:39.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61F2398D-29ED-4CD4-A229-186EF99BB4E8",
              "versionEndExcluding": "2.4.16"
            },
            {
              "criteria": "cpe:2.3:a:rancher:rancher:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67B096D9-719A-43C1-8B49-AF0C09A30715",
              "versionEndExcluding": "2.5.9",
              "versionStartIncluding": "2.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "meissner@suse.de"
}