Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object (SUSE Rancher)
En bref
- Source
- NVD
- EPSS
- EPSS 4.17 % · centile 91 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- suse
- Statut NVD
- Modified
Description
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
Faiblesses (CWE)
- CWE-312 — Stockage en clair d'informations sensibles
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | suse |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · meissner@suse.de (Secondary) |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-g7j7-h4q8-8w2f — Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
Références européennes
- ENISA EUVD · EUVD-2022-6818
- GCVE · GCVE-0-2021-36782
Configurations affectées (CPE NVD)
cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.5.0 < 2.5.16cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*≥ 2.6.0 < 2.6.7
Produits affectés
| Produit | Versions |
|---|---|
| SUSE · Rancher | affected Rancher < 2.5.16 |
| SUSE · Rancher | affected Rancher < 2.6.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |