8.4

CVE-2022-43760

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is 
executed within another user's browser, allowing the attacker to steal 
sensitive information, manipulate web content, or perform other 
malicious activities on behalf of the victims. This could result in a 
user with write access to the affected areas being able to act on behalf
 of an administrator, once an administrator opens the affected web page.


This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Suse ≫ Rancher Version >= 2.6.0 < 2.6.13
Suse ≫ Rancher Version >= 2.7.0 < 2.7.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.97% 0.756
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.4 1.7 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
meissner@suse.de 8.4 1.7 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.