A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.10.0, < 2.10.12CPE match | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | ||
>= 2.11.0, < 2.11.14CPE match | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | ||
>= 2.12.0, < 2.12.10CPE match | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | ||
>= 2.13.0, < 2.13.6CPE match | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* | ||
>= 2.14.0, < 2.14.2CPE match | cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.8 Bluesky, 0.5 Mastodon, and 1.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.