CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2019-12303
High (8.8) in suse rancher. EPSS 2.0% chance of exploitation in the next 30 days. Fixed in github.com/rancher/rancher 2.2.4, 2.2.4+incompatible.
In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container.
Severity
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- suse:rancher
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-53pj-67m4-9w98 | Go | github.com/rancher/rancher | >=2.0.0 <2.2.4 | 2.2.4 |
| GO-2024-2762 | Go | github.com/rancher/rancher | >=2.0.0+incompatible <2.2.4+incompatible | 2.2.4+incompatible |
References
- https://forums.rancher.com/c/announcements
- https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466
- https://forums.rancher.com/c/announcements
- https://forums.rancher.com/t/rancher-release-v2-2-4-addresses-rancher-cve-2019-12274-and-cve-2019-12303/14466