CVSS 3.1
6.2 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:NCVE-2024-52282
Medium (6.2). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/rancher/rancher 2.8.10, 2.9.4.
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET
access to the Rancher Manager Apps Catalog to read any sensitive information that are
contained within the Apps’ values. Additionally, the same information
leaks into auditing logs when the audit level is set to equal or above
2.
This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9c5p-35gj-jqp4 | Go | github.com/rancher/rancher | >=2.8.0 <2.8.10 | 2.8.10 |
| GHSA-9c5p-35gj-jqp4 | Go | github.com/rancher/rancher | >=2.9.0 <2.9.4 | 2.9.4 |
| GO-2024-3280 | Go | github.com/rancher/rancher | all versions | no fix published |