9.9

CVE-2021-36782

Exploit

Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versions prior to 2.5.16; Rancher versions prior to 2.6.7.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Suse ≫ Rancher Version >= 2.5.0 < 2.5.16
Suse ≫ Rancher Version >= 2.6.0 < 2.6.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 79.61% 0.99
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
meissner@suse.de 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-312 Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

https://bugzilla.suse.com/show_bug.cgi?id=1193988
Vendor Advisory
Exploit
Issue Tracking
Mitigation