CVE-2021-36783
Dashboard / Vulnerabilities / CVE-2021-36783
Summary:
Details: A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.
References: https://github.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8, https://bugzilla.suse.com/show_bug.cgi?id=1193990
Affected packages
Package
Name:
Purl:
Affected ranges
Type: GIT
Events:
Introduced- 65f3525cdc1167872af4140d45f3153698450c52
Affected versions
v2.6.5-rc12
v2.6.5
v2.6.6-rc1
v2.6.5-rc11
v2.6.5-rc10
v2.6.5-rc9
v2.6.5-rc8
v2.6.5-rc6
v2.6.5-rc5
v2.6.5-rc4
v2.6.5-rc3
v2.6.5-rc2
v2.6.4-rc11
v2.6.5-rc1
v2.6.4-rc13
v2.6.4-rc12
v2.6.4-rc10
v2.6.4-rc9
v2.6.4-rc8
v2.6.4-rc5
v2.6.4-rc6
v2.6.4-rc4
v2.6.4-rc3
v2.6.4-rc2
v2.6.4-rc1
v2.6.4-alpha3
v2.6.4-alpha2
v2.6.5-alpha1
v2.6.4-alpha1
v2.6.3-rc11
v2.6.3-harvester1
v2.6.3
v2.6.3-rc10
v2.6.3-rc9
v2.6.3-rc8
v2.6.3-rc7
v2.6.3-rc6
v2.6.3-rc5
v2.6.3-rc4
v2.6.3-rc3
v2.6.3-rc2
v2.6.3-rc1
v2.6.1-rc13
v2.6.1-harvester2
v2.6.1
v2.6.1-rc12
v2.6.1-harvester1
v2.6.1-rc11
v2.6.1-rc9
v2.6.1-rc10
v2.6.1-rc2
v2.6.1-rc8
v2.6.1-rc7
v2.6.1-rc6
v2.6.1-rc5
v2.6.1-rc4
v2.6.1-rc3
v2.6.1-rc1
v2.6.0-rc10
v2.6.0
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
