7.7
CVE-2024-52284
- EPSS 0.01%
- Published 02.09.2025 11:49:49
- Last modified 02.09.2025 15:55:25
- Source meissner@suse.de
- Teams watchlist Login
- Open Login
Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users. Login
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorSUSE
≫
Product
Rancher
Default Statusunaffected
Version <
0.13.1-0.20250806151509-088bcbea7edb
Version
0.13.0
Status
affected
Version <
0.12.6
Version
0.12.0
Status
affected
Version <
0.11.10
Version
0.11.0
Status
affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.01% | 0.017 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| meissner@suse.de | 7.7 | 3.1 | 4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
|
CWE-312 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.