Lucene search

GoogleOSV:GO-2024-2784

HistoryJun 10, 2024 - 4:39 p.m.

Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher

2024-06-1016:39:03

Google

osv.dev

rancher

default user

known password

deletion

software

github

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.6%

JSON

Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher

CPENameOperatorVersion
github.com/rancher/rancherge2.0.0+incompatible
github.com/rancher/rancherge2.1.0+incompatible
github.com/rancher/rancherlt2.2.2+incompatible
github.com/rancher/rancherge2.2.0+incompatible

Name	Operator	Version
github.com/rancher/rancher	ge	2.0.0+incompatible
github.com/rancher/rancher	ge	2.1.0+incompatible
github.com/rancher/rancher	lt	2.2.2+incompatible
github.com/rancher/rancher	ge	2.2.0+incompatible

References

forums.rancher.com/t/rancher-release-v2-2-2-addresses-rancher-cve-2019-11202-and-stability-issues/13977

github.com/advisories/GHSA-xh8x-j8h3-m5ph

nvd.nist.gov/vuln/detail/CVE-2019-11202

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.6%

JSON

Related for OSV:GO-2024-2784