by Kastro
Paper/Archive/CVE-2021-36783

CVE-2021-36783

SUSE Rancher — Rancher: Failure to properly sanitize credentials in cluster template answers

EPSS 0.8%CVSS 9.9
critical.is priorityof 100
41
CVSS 9.9 (CNA, NVD agree)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.

Affected

ProductAffectedFixed inSource
RancherRancher – < 2.6.42.6.4CNA
RancherRancher – < 2.5.132.5.13CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
suse (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refbugzilla.suse.com/show_bug.cgi?id=1193990refgithub.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8