CVE-2019-12303

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://forums.rancher.com/c/announcementsRelease Notes, Vendor Advisory
https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466Release Notes, Vendor Advisory
https://forums.rancher.com/c/announcementsRelease Notes, Vendor Advisory
https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466Release Notes, Vendor Advisory

Timeline

Published: Jun 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-123056.5In EZCast Pro II, the administrator password md5 hash is provided upon a web request. This hash can be cracked to access the administration CVE-2019-123086.1An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by CVE-2019-123094.9dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the i CVE-2019-12315.9An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information CVE-2019-123109.8ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remot CVE-2019-123116.1Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded CVE-2019-123127.5In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiat CVE-2019-123136.1XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.CVE-2019-123149.8Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cg CVE-2019-123156.1Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the "print from file" fea CVE-2019-12327.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file oper CVE-2019-123237.5The HC.Server service in Hosting Controller HC10 10.14 allows an Invalid Pointer Write DoS.