fkie_cve-2025-23387
Vulnerability from fkie_nvd
Published
2025-04-11 11:15
Modified
2025-04-11 15:39
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.
References
meissner@suse.dehttps://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387
meissner@suse.dehttps://github.com/rancher/rancher/security/advisories/GHSA-5qmp-9x47-92q8
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado en SUSE Rancher permit\u00eda a usuarios no autenticados enumerar todos los tokens de autenticaci\u00f3n de la CLI y eliminarlos antes de que la CLI pueda obtener el valor del token. Este problema afecta a Rancher: desde la versi\u00f3n 2.8.0 hasta la 2.8.13, desde la versi\u00f3n 2.9.0 hasta la 2.9.7, desde la versi\u00f3n 2.10.0 hasta la 2.10.3."
    }
  ],
  "id": "CVE-2025-23387",
  "lastModified": "2025-04-11T15:39:52.920",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "meissner@suse.de",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-11T11:15:42.367",
  "references": [
    {
      "source": "meissner@suse.de",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387"
    },
    {
      "source": "meissner@suse.de",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5qmp-9x47-92q8"
    }
  ],
  "sourceIdentifier": "meissner@suse.de",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "meissner@suse.de",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.