CVE-2023-22650 — Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

CVE-2023-22650

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider PUBLISHED

Description (CNA)

A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.

Affected (CNA)

Vendor / product	Versions
SUSE / rancher	affected 2.7.0 before 2.7.14; affected 2.8.0 before 2.8.5

CWE

CWE-287

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650
https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.