6.8

CVE-2022-21951

Exploit

Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Suse ≫ Rancher Version >= 2.5.0 < 2.5.14
Suse ≫ Rancher Version >= 2.6.0 < 2.6.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.08% 0.202
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 1.6 5.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 3.6 3.9 4.9
AV:N/AC:H/Au:S/C:P/I:P/A:N
meissner@suse.de 6.8 1.6 5.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

https://bugzilla.suse.com/show_bug.cgi?id=1199443
Third Party Advisory
Issue Tracking