Vulnerability Details : CVE-2021-36783
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.
Products affected by CVE-2021-36783
- cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
- cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-36783
0.23%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 42 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-36783
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
SUSE | |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
NIST |
CWE ids for CVE-2021-36783
-
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.Assigned by:
- meissner@suse.de (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2021-36783
-
https://bugzilla.suse.com/show_bug.cgi?id=1193990
Bug 1193990 – CVE-2021-36783: Rancher - Failure to properly sanitize credentials in cluster template answersIssue Tracking;Vendor Advisory
-
https://github.com/rancher/rancher/security/advisories/GHSA-8w87-58w6-hfv8
Failure to properly sanitize credentials in cluster template answers · Advisory · rancher/rancher · GitHubThird Party Advisory
Jump to