CVE-2024-52281 - Vulnerability Details - OpenCVE

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281
https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9

History

Wed, 16 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 16 Apr 2025 08:45:00 +0000

Type	Values Removed	Values Added
Description		A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.
Title		Stored Cross-site Scripting vulnerability in Rancher UI
Weaknesses		CWE-79
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281 https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9
Metrics		cvssV3_1 `{'score': 8.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2025-04-16T08:31:11.378Z

Updated: 2025-04-18T03:55:42.362Z

Reserved: 2024-11-06T12:19:57.723Z

Link: CVE-2024-52281

Vulnrichment

Updated: 2025-04-16T14:22:54.937Z

NVD

Status : Awaiting Analysis

Published: 2025-04-16T09:15:27.620

Modified: 2025-04-16T13:25:37.340

Link: CVE-2024-52281

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52281", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2024-11-06T12:19:57.723Z", "datePublished": "2025-04-16T08:31:11.378Z", "dateUpdated": "2025-04-18T03:55:42.362Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "github.com/rancher/rancher", "product": "rancher", "vendor": "SUSE", "versions": [{"lessThan": "2.9.4", "status": "affected", "version": "2.9.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was identified and reported by Bhavin Makwana from Workday\u2019s Cyber Defence Team"}], "datePublic": "2025-01-14T21:03:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.<br><p>This issue affects rancher: from 2.9.0 before 2.9.4.</p>"}], "value": "A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2025-04-16T08:31:11.378Z"}, "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9"}], "source": {"discovery": "EXTERNAL"}, "title": "Stored Cross-site Scripting vulnerability in Rancher UI", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-17T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-52281"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-18T03:55:42.362Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52281", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T14:19:41.351185Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:22:54.937Z"}}], "cna": {"title": "Stored Cross-site Scripting vulnerability in Rancher UI", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "This issue was identified and reported by Bhavin Makwana from Workday\u2019s Cyber Defence Team"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "rancher", "versions": [{"status": "affected", "version": "2.9.0", "lessThan": "2.9.4", "versionType": "semver"}], "packageName": "github.com/rancher/rancher", "defaultStatus": "unaffected"}], "datePublic": "2025-01-14T21:03:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.", "supportingMedia": [{"type": "text/html", "value": "A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.<br><p>This issue affects rancher: from 2.9.0 before 2.9.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2025-04-16T08:31:11.378Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52281", "state": "PUBLISHED", "dateUpdated": "2025-04-18T03:55:42.362Z", "dateReserved": "2024-11-06T12:19:57.723Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2025-04-16T08:31:11.378Z", "assignerShortName": "suse"}, "dataVersion": "5.1"}