CVE-2022-43760
published 2023-06-01CVE-2022-43760: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged…
PriorityP335high8.4CVSS 3.1
AVNACLPRHUIRSCCHIHAH
EPSS
0.71%
49.0th percentile
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is
executed within another user's browser, allowing the attacker to steal
sensitive information, manipulate web content, or perform other
malicious activities on behalf of the victims. This could result in a
user with write access to the affected areas being able to act on behalf
of an administrator, once an administrator opens the affected web page.
This issue affects Rancher: from >= 2.6.0 before = 2.7.0 before < 2.7.4.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | rancher_rancher | >= 2.6.0 < 2.6.13 | 2.6.13 |
| github.com | rancher_rancher | >= 2.7.0 < 2.7.4 | 2.7.4 |
| suse | rancher | >= 2.6.0 < 2.6.13 | 2.6.13 |
| suse | rancher | >= 2.7.0 < 2.7.4 | 2.7.4 |
| suse | rancher | >= >= 2.6.0 < < 2.6.13 | < 2.6.13 |
| suse | rancher | >= >= 2.7.0 < < 2.7.4 | < 2.7.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Rancher UI has multiple Cross-Site Scripting (XSS) issues
osv·2023-06-06
CVE-2022-43760 [MEDIUM] Rancher UI has multiple Cross-Site Scripting (XSS) issues
Rancher UI has multiple Cross-Site Scripting (XSS) issues
### Impact
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in the Rancher UI.
Cross-Site scripting allows a malicious user to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page.
The affected areas include the Projects/Namespaces and Auth Provider sections. The attacker needs to be authenticated and have write access to those features in order to exploit the vulnerabilities. Some of the permissi
GHSA
Rancher UI has multiple Cross-Site Scripting (XSS) issues
ghsa·2023-06-06
CVE-2022-43760 [MEDIUM] CWE-79 Rancher UI has multiple Cross-Site Scripting (XSS) issues
Rancher UI has multiple Cross-Site Scripting (XSS) issues
### Impact
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in the Rancher UI.
Cross-Site scripting allows a malicious user to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page.
The affected areas include the Projects/Namespaces and Auth Provider sections. The attacker needs to be authenticated and have write access to those features in order to exploit the vulnerabilities. Some of the permissi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-06-01
Published