Riskcovery

CVE-2024-52280

Users can issue watch commands for arbitrary resources

State
Published
Severity
7.7 High
Published
Apr 11, 2025
Updated
Apr 11, 2025
Reserved
Nov 6, 2024

Read the record on cve.org

Description

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsuse

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
rancherSUSE
  • before 2175e09Affected
  • before 6e30359Affected
  • before c744f0bAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.