Paper/Archive/CVE-2021-36782

CVE-2021-36782

SUSE Rancher — Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

EPSS 4%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA, NVD agree)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 90.9.909 × 2018.2 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.

Affected

ProductAffectedFixed inSource

RancherRancher – < 2.5.162.5.16CNA

RancherRancher – < 2.6.72.6.7CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

suse (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refbugzilla.suse.com/show_bug.cgi?id=1193988 refgithub.com/rancher/rancher/security/advisories/GHSA-g7j7-h4q8-8w2f