CVE-2017-7297

    Dashboard / Vulnerabilities / CVE-2017-7297

    CVE-2017-7297

    Published: 29 Mar 2017Last Modified: 7 Aug 2026

    Summary:

    Details: Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.

    References: http://www.securityfocus.com/bid/97180, https://github.com/rancher/rancher/issues/8296

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 9267089303442680b271aa193a59eda04525c0b2
    Fixed -0d6a08109a68e0a1c290718bbd53442427bd99b7

    Affected versions

    v1.2.4-rc2
    v1.2.4-rc1
    v1.2.3
    v1.2.3-rc2
    v1.2.3-rc1
    v1.2.2
    v1.2.2-rc4
    v1.2.2-rc3
    v1.2.2-rc2
    v1.2.2-rc1
    v1.2.1
    v1.2.1-rc4
    v1.2.1-rc3
    v1.2.1-rc2
    v1.2.1-rc1
    v1.2.0-1
    v1.2.0.1-rc1
    v1.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High