Description (CNA)
When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SUSE / rke | affected 1.4.18 before 1.4.19; affected 1.5.9 before 1.5.10 |
CWE
CWE-922
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32191
- https://github.com/rancher/rke/security/advisories/GHSA-6gr4-52w6-vmqx
ADP enrichment
No English description supplied.
No references supplied.