CVE-2021-25320
Dashboard / Vulnerabilities / CVE-2021-25320
CVE-2021-25320
Published: 15 Jul 2021Last Modified: 7 Aug 2026
Summary:
Details: A Improper Access Control vulnerability in Rancher, allows users in the cluster to make request to cloud providers by creating requests with the cloud-credential ID. Rancher in this case would attach the requested credentials without further checks This issue affects: Rancher versions prior to 2.5.9; Rancher versions prior to 2.4.16.
Affected packages
Package
Name:
Purl:
Affected ranges
Affected versions
v2.4.16-rc1
v2.4.16-rc5
v2.4.16-rc4
v2.4.16-rc3
v2.4.16-rc2
v2.4.15
v2.4.14-rc4
v2.4.14-rc3
v2.4.14
v2.4.14-rc2
v2.4.14-rc1
v2.4.13-rc6
v2.4.13
v2.4.13-rc5
v2.4.13-rc4
v2.4.13-rc3
v2.4.13-rc2
v2.4.13-rc1
v2.4.9-rc4
v2.4.0-rc9
v2.4.11-rc6
v2.4.11
v2.4.11-rc2
v2.4.11-rc5
v2.4.11-rc4
v2.4.11-rc3
v2.4.11-rc1
v2.4.9-rc12
v2.4.9
v2.4.10-rc1
v2.4.10
v2.4.9-rc11
v2.4.9-rc10
v2.4.9-rc9
v2.4.9-rc8
v2.4.9-rc7
v2.4.9-rc6
v2.4.9-rc5
v2.4.9-rc3
v2.4.9-rc2
v2.4.9-rc1
v2.4.8-rc3
v2.4.8
v2.4.8-rc2
v2.4.8-rc1
v2.4.7
v2.4.7-rc3
v2.4.7-rc2
v2.4.7-rc1
v2.4.6-rc12
v2.4.6
v2.4.6-rc11
v2.4.6-rc10
v2.4.6-rc9
v2.4.6-rc8
v2.4.6-rc7
v2.4.6-rc6
v2.4.6-rc5
v2.4.6-rc4
v2.4.6-rc1
v2.4.6-rc3
v2.4.6-rc2
v2.4.5-rc5
v2.4.5-rc10
v2.4.5
v2.4.5-rc9
v2.4.5-rc8
v2.4.5-rc7
v2.4.5-rc6
v2.4.5-rc4
v2.4.5-rc3
v2.4.5-rc2
v2.4.5-rc1
v2.4.3
v2.4.4-rc1
v2.4.3-rc7
v2.4.3-rc6
v2.4.3-rc5
v2.4.3-rc4
v2.4.3-rc3
v2.4.3-rc2
v2.4.3-rc1
v2.4.2-rc3
v2.4.2
v2.4.2-rc2
v2.4.2-rc1
v2.4.1-rc2
v2.4.1-rc1
v2.4.0-rc18
v2.4.0
v2.4.0-rc17
v2.4.0-rc16
v2.4.0-rc15
v2.4.0-rc14
v2.4.0-rc13
v2.4.0-rc12
v2.4.0-rc11
v2.4.0-rc10
v2.4.0-rc8
v2.4.0-rc7
v2.4.0-rc6
v2.4.0-rc5
v2.4.0-rc4
v2.4.0-rc3
v2.4.0-rc2
v2.4.0-rc1
v2.4.0-alpha1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
