CVE-2023-32192

Rancher API Server Cross-site Scripting Vulnerability

State: Published
Severity: 8.3 High
Published: Oct 16, 2024
Updated: Oct 16, 2024
Reserved: May 4, 2023

Description

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L	suse

Weaknesses

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page

Affected Products

Product	Versions
apiserverSUSE	before 0.0.0-20240207153957-4fd7d821d952Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32192
https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.