Rancher: Non-random authentication token
CVE-2022-43755

7.1HIGH

Key Information:

Vendor
Suse
Status
Rancher
Vendor
CVE Published:
7 February 2023

Summary

An Insufficient Entropy vulnerability in SUSE Rancher allows attackers who acquire the cattle-token to exploit the system repeatedly, even after the token is renewed. This presents a significant security risk as it can allow unauthorized actions within the system. It affects specific versions of SUSE Rancher, underscoring the necessity for immediate updates to mitigate potential impacts.

Affected Version(s)

Rancher Rancher < 2.6.10

References

https://bugzilla.suse.com/show_bug.cgi?id=1205297

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.