CVE-2021-31999

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-807

Affected software

Vendor	Product	Versions
Rancher	Rancher	>= Rancher, < 2.5.9
Rancher	SUSE Linux Enterprise Server 15	>= Rancher, < 2.4.16

References

https://bugzilla.suse.com/show_bug.cgi?id=1187084Issue Tracking, Release Notes, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1187084Issue Tracking, Release Notes, Third Party Advisory

Timeline

Published: Jul 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-32003.3Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, c CVE-2021-320007.1A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterpr CVE-2021-320016.5K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confident CVE-2021-320023.3Improper Access Control vulnerability in web service of Secomea SiteManager allows local attacker without credentials to gather network info CVE-2021-320035.5Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the s CVE-2021-320045.3This issue affects: Secomea GateManager All versions prior to 9.6. Improper Check of host header in web server of Secomea GateManager allows CVE-2021-320055.4Cross-site Scripting (XSS) vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution.CVE-2021-320064.3This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Permission Issues vulnerability in LinkManager web por CVE-2021-320073.5This issue affects: Secomea GateManager Version 9.5 and all prior versions. Protection Mechanism Failure vulnerability in web server of Seco CVE-2021-320088.7This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted direct CVE-2021-320096.1Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject javascript in browser se CVE-2021-320108.1Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle