CVE-2022-43758

Rancher: Command injection in Git package

State: Published
Severity: 7.6 High
Published: Feb 7, 2023
Updated: Mar 25, 2025
Reserved: Oct 26, 2022

Description

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H	suse

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
RancherSUSE	Rancher to before 2.5.17Affectedfrom 2.6.10Not affectedfrom 2.7.1Not affected

References

https://bugzilla.suse.com/show_bug.cgi?id=1205294

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.