Rancher LPE Vulnerability CVE-2024-22031: Users can access arbitrary projects

Vulnerability Overview Vulnerability ID: CVE-2024-22031 Title: Rancher: Users who can create Projects can gain access to arbitrary projects Status: NEW Severity: Critical Product: SUSE Security Incidents Component: Unknown (in other bugs) Version: unspecified Hardware: Other Other Priority: P1 - None Severity: Critical Target Milestone: --- Assigned To: Security Team bug QA Contact: Security Team bug URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 Keywords: Whiteboard: --- Depends on: --- Blocks: --- Reported Time: 2024-04-19 16:01 UTC by Pietro Dell'Aroma Modified Time: 2024-10-15 08:17 UTC (history) CC List: 4 users (view) Service Priority: Business Priority Blocker: --- Impact Scope Product: SUSE Security Incidents Component: Unknown (in other bugs) Version: unspecified Hardware: Other Other Fix Plan Status: NEW Priority: P1 - None Severity: Critical Target Milestone: --- Assigned To: Security Team bug QA Contact: Security Team bug Comments 1. Marcus Meissner (2024-04-22 14:24:07 UTC) - Note: You need to log in before you can comment on or make changes to this bug. - Comment 1: --- 2. Pietro Dell'Aroma (2024-04-20 13:29:05 UTC) - Comment 2: --- 3. Johannes Segitz (2024-10-15 08:17:51 UTC) - Comment 3: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Attachments Add an attachment (processed patch, text/xml, etc.): --- Additional Information Clone This Bug: --- See Also: --- Found By: --- Services Priority: Business Priority Blocker: --- Links URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 GitHub Link: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Notes Note: You need to log in before you can comment on or make changes to this bug. Comment Details 1. Marcus Meissner (2024-04-22 14:24:07 UTC) - Comment 1: --- 2. Pietro Dell'Aroma (2024-04-20 13:29:05 UTC) - Comment 2: --- 3. Johannes Segitz (2024-10-15 08:17:51 UTC) - Comment 3: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Attachments Add an attachment (processed patch, text/xml, etc.): --- Additional Information Clone This Bug: --- See Also: --- Found By: --- Services Priority: Business Priority Blocker: --- Links URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 GitHub Link: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Notes Note: You need to log in before you can comment on or make changes to this bug. Comment Details 1. Marcus Meissner (2024-04-22 14:24:07 UTC) - Comment 1: --- 2. Pietro Dell'Aroma (2024-04-20 13:29:05 UTC) - Comment 2: --- 3. Johannes Segitz (2024-10-15 08:17:51 UTC) - Comment 3: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Attachments Add an attachment (processed patch, text/xml, etc.): --- Additional Information Clone This Bug: --- See Also: --- Found By: --- Services Priority: Business Priority Blocker: --- Links URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 GitHub Link: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Notes Note: You need to log in before you can comment on or make changes to this bug. Comment Details 1. Marcus Meissner (2024-04-22 14:24:07 UTC) - Comment 1: --- 2. Pietro Dell'Aroma (2024-04-20 13:29:05 UTC) - Comment 2: --- 3. Johannes Segitz (2024-10-15 08:17:51 UTC) - Comment 3: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Attachments Add an attachment (processed patch, text/xml, etc.): --- Additional Information Clone This Bug: --- See Also: --- Found By: --- Services Priority: Business Priority Blocker: --- Links URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 GitHub Link: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Notes Note: You need to log in before you can comment on or make changes to this bug. Comment Details 1. Marcus Meissner (2024-04-22 14:24:07 UTC) - Comment 1: --- 2. Pietro Dell'Aroma (2024-04-20 13:29:05 UTC) - Comment 2: --- 3. Johannes Segitz (2024-10-15 08:17:51 UTC) - Comment 3: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Attachments Add an attachment (processed patch, text/xml, etc.): --- Additional Information Clone This Bug: --- See Also: --- Found By: --- Services Priority: Business Priority Blocker: --- Links URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 GitHub Link: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Notes Note: You need to log in before you can comment on or make changes to this bug. Comment Details 1. Marcus Meissner (2024-04-22 14:24:07 UTC) - Comment 1: --- 2. Pietro Dell'Aroma (2024-04-20 13:29:05 UTC) - Comment 2: --- 3. Johannes Segitz (2024-10-15 08:17:51 UTC) - Comment 3: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Attachments Add an attachment (processed patch, text/xml, etc.): --- Additional Information Clone This Bug: --- See Also: --- Found By: --- Services Priority: Business Priority Blocker: --- Links URL: https://bugzilla.suse.com/show_bug.cgi?id=1223154 GitHub Link: https://github.com/rancher/ui-legacy/blob/8e8e-8e8e-229e Notes Note: You need to log in before you can comment on or make change

Goal Reached Thanks to every supporter — we hit 100%!

Rancher LPE Vulnerability CVE-2024-22031: Users can access arbitrary projects