{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.0"
            },
            {
              "fixed": "2.5.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21953"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-285",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-25T19:36:09Z",
    "nvd_published_at": "2023-02-07T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAn issue was discovered in Rancher where an authorization logic flaw allows an authenticated user on any downstream cluster to (1) open a shell pod in the Rancher `local` cluster and (2) have limited `kubectl` access to it. The expected behavior is that a user does not have such access in the Rancher `local` cluster unless explicitly granted.\n\nThis issue does not allow the user to escalate privileges in the `local` cluster directly (this would require another vulnerability to be exploited).\n\nThe security issue happens in two different ways:\n\n1. Shell pod access - This is when a user opens a shell pod in the Rancher UI to a downstream cluster that the user has permission to access. The web request can be intercepted using the browser\u0027s web inspector/network console or a proxy tool to change the shell\u0027s destination to the Rancher `local` cluster instead of the desired downstream cluster.\n\n   - This flaw cannot be exploited to access a downstream cluster that the user has no permissions to.\n\n   - The shell pod runs with a limited non-root user, reducing the severity of this issue. However, even as a non-root user, it is still possible download and run binaries inside the shell pod.\n\n   - The blast radius of this issue can increase based on the configuration of the `local` cluster. For example:\n\n      - If the `local` cluster has unlimited network access, e.g. to the Internet, the user can open a reverse network connection to the shell pod.\n\n      - Or access the cloud metadata API of the underlying cloud infrastructure, where the user can extract the credentials associated with the `local` cluster and use them to interact with the cloud environment (this will be limited by the permissions granted to the cloud credentials in question). \n\n      - Check further recommendations about liming access to the cloud metadata API in Rancher\u0027s [security best practices](https://ranchermanager.docs.rancher.com/reference-guides/rancher-security/kubernetes-security-best-practices).\n\n2. Kubectl access - When downloading the kubeconfig file of a downstream cluster that the user has access to, the `server` cluster address in the kubeconfig file can be changed to point to the Rancher `local` cluster instead of the intended downstream cluster.\n\n     - This can also be achieved by crafting a kubeconfig using a Rancher token instead of using the kubeconfig from an active cluster. \n\n    - This flaw cannot be exploited to access a downstream cluster that the user has no permissions to.\n\nNotes:\n- Rancher `local` cluster means the cluster where Rancher is installed. It is named as `local` inside the list of clusters in the Rancher UI.\n- Audit logs in Rancher can be used to identify possible abuses of this issue, by tracking API requests to the user ID of the user that performed the action. API audit logs can be enabled as described in the [documentation](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) when set to level `1` or above.\n\n### Workarounds\n\nThere is no workaround or direct mitigation besides updating to a patched Rancher version.\n\n### Patches\n\nPatched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-g25r-gvq3-wrq7",
  "modified": "2023-02-07T15:49:33Z",
  "published": "2023-01-25T19:36:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-g25r-gvq3-wrq7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21953"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1199731"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster"
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Rancher ist ein Werkzeug f\u00fcr die Verwaltung von Kubernetes-Container basierten Umgebungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, seine Rechte zu erweitern und Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX\n- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0197 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0197.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0197 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0197"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-01-24",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-8c69-r38j-rpfj"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-01-24",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-34p5-jp77-fcrc"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-01-24",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-cq4p-vp5q-4522"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-01-24",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-7m72-mh5r-6j3r"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-01-24",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-c45c-39f6-6gw9"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2023-01-24",
        "url": "https://github.com/rancher/rancher/security/advisories/GHSA-g25r-gvq3-wrq7"
      }
    ],
    "source_lang": "en-US",
    "title": "Rancher: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-01-24T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T17:11:30.000+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2023-0197",
      "initial_release_date": "2023-01-24T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-01-24T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Rancher Rancher \u003c 2.5.17",
                "product": {
                  "name": "Rancher Rancher \u003c 2.5.17",
                  "product_id": "T026022",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rancher:rancher:2.5.17"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Rancher Rancher \u003c 2.6.10",
                "product": {
                  "name": "Rancher Rancher \u003c 2.6.10",
                  "product_id": "T026023",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rancher:rancher:2.6.10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Rancher Rancher \u003c 2.7.1",
                "product": {
                  "name": "Rancher Rancher \u003c 2.7.1",
                  "product_id": "T026024",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rancher:rancher:2.7.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rancher"
          }
        ],
        "category": "vendor",
        "name": "Rancher"
      }
    ]
  },
  "vulnerabilities": [
    {
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Rancher. Wenn ein externer Authentifizierungsanbieter in Rancher konfiguriert und dann deaktiviert wird, werden die von Rancher generierten Token, denen der Zugriff \u00fcber den nun deaktivierten Authentifizierungsanbieter gew\u00e4hrt wurde, nicht widerrufen. Ein authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "release_date": "2023-01-24T23:00:00Z"
    },
    {
      "cve": "CVE-2022-43759",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Rancher. Diese beruht auf einem Fehler in der Autorisierungslogik. Ein privilegierter Angreifer kann diese Schwachstelle ausnutzen, um seine Privilegien \u00fcber Project Role Template Binding (PRTB) und -promotierte Rollen zu erweitern."
        }
      ],
      "release_date": "2023-01-24T23:00:00Z",
      "title": "CVE-2022-43759"
    },
    {
      "cve": "CVE-2022-43758",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Rancher. Das Rancher-Git-Paket verwendet die zugrunde liegende Git-Bin\u00e4rdatei, die im Rancher-Container-Image verf\u00fcgbar ist, um Git-Operationen auszuf\u00fchren. In diesem Paket besteht ein Befehls-Injektions-Problem. Ein privilegierter Angreifer kann diese Schwachstelle ausnutzen, um Befehle in den zugrunde liegenden Rancher-Host zu injizieren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "release_date": "2023-01-24T23:00:00Z",
      "title": "CVE-2022-43758"
    },
    {
      "cve": "CVE-2022-43757",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Rancher. Einige vertrauliche Felder, geheime Token, Verschl\u00fcsselungsschl\u00fcssel und SSH-Schl\u00fcssel werden im Klartext direkt auf Kubernetes-Objekten wie Clustern gespeichert. Ein authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen."
        }
      ],
      "release_date": "2023-01-24T23:00:00Z",
      "title": "CVE-2022-43757"
    },
    {
      "cve": "CVE-2022-43755",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Rancher. Das cattle-token-Geheimnis verwendet keinen Zufallswert in seiner Zusammensetzung, was dazu f\u00fchrt, dass es immer mit demselben Wert neu generiert wird. Ein authentisierter Angreifer kann diese Schwachstelle ausnutzen, um die Rechte des Clustereigent\u00fcmers des betroffenen Downstream-Clusters zu erweitern."
        }
      ],
      "release_date": "2023-01-24T23:00:00Z",
      "title": "CVE-2022-43755"
    },
    {
      "cve": "CVE-2022-21953",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Rancher. Ein Fehler in der Autorisierungslogik erm\u00f6glicht es einem authentifizierten Benutzer auf einem beliebigen nachgelagerten Cluster einen Shell-Pod im lokalen Rancher-Cluster zu \u00f6ffnen und begrenzten kubectl-Zugriff darauf zu erhalten. Ein authentisierter Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen."
        }
      ],
      "release_date": "2023-01-24T23:00:00Z",
      "title": "CVE-2022-21953"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2022-21953",
    "description": "A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.",
    "id": "GSD-2022-21953",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-21953.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-21953"
      ],
      "details": "A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.",
      "id": "GSD-2022-21953",
      "modified": "2023-12-13T01:19:14.540979Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@suse.com",
        "DATE_PUBLIC": "2023-01-25T00:00:00.000Z",
        "ID": "CVE-2022-21953",
        "STATE": "PUBLIC",
        "TITLE": "Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster "
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Rancher",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "Rancher",
                          "version_value": "2.5.17"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "Rancher",
                          "version_value": "2.6.10"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "Rancher",
                          "version_value": "2.7.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "SUSE"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-862: Missing Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugzilla.suse.com/show_bug.cgi?id=1199731",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1199731"
          }
        ]
      },
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1199731",
        "defect": [
          "1199731"
        ],
        "discovery": "INTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=v2.5.0 \u003cv2.5.17 || \u003e=v2.6.0 \u003cv2.6.10 || \u003e=v2.7.0 \u003cv2.7.1",
          "affected_versions": "All versions starting from 2.5.0 before 2.5.17, all versions starting from 2.6.0 before 2.6.10, all versions starting from 2.7.0 before 2.7.1",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-01-25",
          "description": "An issue was discovered in Rancher where an authorization logic flaw allows an authenticated user on any downstream cluster to (1) open a shell pod in the Rancher `local` cluster and (2) have limited `kubectl` access to it.",
          "fixed_versions": [
            "v2.5.17",
            "v2.6.10",
            "v2.7.1"
          ],
          "identifier": "GMS-2023-143",
          "identifiers": [
            "GHSA-g25r-gvq3-wrq7",
            "GMS-2023-143",
            "CVE-2022-21953"
          ],
          "not_impacted": "All versions before 2.5.0, all versions starting from 2.5.17 before 2.6.0, all versions starting from 2.6.10 before 2.7.0, all versions starting from 2.7.1",
          "package_slug": "go/github.com/rancher/rancher",
          "pubdate": "2023-01-25",
          "solution": "Upgrade to versions 2.5.17, 2.6.10, 2.7.1 or above.",
          "title": "Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster",
          "urls": [
            "https://github.com/rancher/rancher/security/advisories/GHSA-g25r-gvq3-wrq7",
            "https://github.com/advisories/GHSA-g25r-gvq3-wrq7"
          ],
          "uuid": "af786d32-1184-4080-ad9a-2e4fb77195ab",
          "versions": [
            {
              "commit": {
                "sha": "65f3525cdc1167872af4140d45f3153698450c52",
                "tags": [
                  "v2.5.0",
                  "v2.5.0-rc9"
                ],
                "timestamp": "20201006004413"
              },
              "number": "v2.5.0"
            },
            {
              "commit": {
                "sha": "df2432ad895c9d6be0e47e0d6d62a4c3dc8f08e5",
                "tags": [
                  "v2.6.0",
                  "v2.6.0-rc10"
                ],
                "timestamp": "20210830223634"
              },
              "number": "v2.6.0"
            },
            {
              "commit": {
                "sha": "ce9a7aea4b13fed7acd02cc32667b2ae72f98f5a",
                "tags": [
                  "v2.7.0",
                  "v2.7.0-novkdm"
                ],
                "timestamp": "20221116161032"
              },
              "number": "v2.7.0"
            },
            {
              "commit": {
                "sha": "8bcacfeafe7c8b7696318c1eb739247258e83238",
                "tags": [
                  "v2.5.17",
                  "v2.5.17-rc4"
                ],
                "timestamp": "20230124044749"
              },
              "number": "v2.5.17"
            },
            {
              "commit": {
                "sha": "2207cfed180315c015223c07ba4462888b8acf9f",
                "tags": [
                  "v2.6.10",
                  "v2.6.10-rc7"
                ],
                "timestamp": "20230124173128"
              },
              "number": "v2.6.10"
            },
            {
              "commit": {
                "sha": "bb1c35fc4258ada8829c187ca17fe28a6e61da4d",
                "tags": [
                  "v2.7.1",
                  "v2.7.1-rc5"
                ],
                "timestamp": "20230124173332"
              },
              "number": "v2.7.1"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.7.1",
                "versionStartIncluding": "2.7.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.6.10",
                "versionStartIncluding": "2.6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.5.17",
                "versionStartIncluding": "2.5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "ID": "CVE-2022-21953"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-862"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1199731",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking"
              ],
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1199731"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-02-16T22:23Z",
      "publishedDate": "2023-02-07T13:15Z"
    }
  }
}