Vulnerability · Published Apr 11, 2025 · Assigned by suse
CVE-2024-52282Rancher Helm Applications may have sensitive values leaked
Medium 6.2
In plain English
A medium-severity information exposure in rancher from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing logs when the audit level is set to equal or above 2. This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/rancher/rancher | 2.8.10 | GHSA-9c5p-35gj-jqp4 |
| Go | github.com/rancher/rancher | 2.9.4 | GHSA-9c5p-35gj-jqp4 |
| Go | github.com/rancher/rancher | no fix listed | GO-2024-3280 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N