Users can issue watch commands for arbitrary resources (SUSE rancher)
En bref
- Source
- NVD
- EPSS
- EPSS 0.48 % · centile 42 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- suse
- Statut NVD
- Deferred
Rechercher sur…
Description
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | suse |
| CVSS 3.1 | HIGH 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | NVD · meissner@suse.de (Secondary) |
Avis
- GHSA-j5hq-5jcr-xwx7 — github.com/rancher/steve's users can issue watch commands for arbitrary resources
- GO-2024-3281 — github.com/rancher/steve's users can issue watch commands for arbitrary resources in github.com/rancher/steve
Références européennes
- ENISA EUVD · EUVD-2024-3361
- GCVE · GCVE-0-2024-52280
Produits affectés
| Produit | Versions |
|---|---|
| SUSE · rancher | affected 0 < 2175e09 ; affected 0 < 6e30359 ; affected 0 < c744f0b |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |