PT-2025-2922 · Rancher+1 · Rancher+1

Published 2025-01-14 · Updated 2025-04-16 · CVE-2024-52281

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.9.4 Rancher versions prior to 2.10.0

Description A vulnerability in the Rancher UI allows a malicious actor to perform a Stored XSS attack through the cluster description field. This could allow malicious actors to execute arbitrary JavaScript code, putting production environments at significant risk. The issue is related to the lack of protection of the web page structure.

Recommendations For versions prior to 2.9.4, upgrade to version 2.9.4 or later. For versions prior to 2.10.0, upgrade to version 2.10.0 or later. As a temporary workaround, consider restricting access to the cluster description field until a patch is applied. Replace the v-tooltip directive with the v-clean-tooltip directive to sanitize HTML code before rendering.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-01561

CVE-2024-52281

GHSA-2V2W-8V8C-WCM9

GO-2025-3391

OPENSUSE-SU-2025:14653-1

OPENSUSE-SU-2025_0297-1

SUSE-SU-2025:0297-1

Affected Products

Rancher

Suse

References · 56

• https://osv.dev/vulnerability/GO-2025-3391 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01561 · Security Note
• https://osv.dev/vulnerability/GHSA-2v2w-8v8c-wcm9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52281 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:0297-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14653-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52281 · Vendor Advisory
• https://github.com/rancher/rancher · Note
• https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9 · Note
• https://t.me/cvetracker/21731 · Telegram Post
• https://twitter.com/fridaysecurity/status/1880076354030587976 · Twitter Post
• https://suse.com/support/update/announcement/2025/suse-su-20250297-1 · Note
• https://suse.com/security/cve/CVE-2025-24354 · Note
• https://twitter.com/cybercronai/status/1912498905687744665 · Twitter Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/3ISCFQBRATG2LAA3K5XNETXSCP77AAKA · Note