Exposure of vSphere's CPI and CSI credentials in Rancher (SUSE rancher)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.44 % · percentile 38 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- suse
- NVD status
- Deferred
Description
A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.
Weaknesses (CWE)
- CWE-522 — Insufficiently Protected Credentials
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | suse |
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L | suse |
| CVSS 4.0 | HIGH 8.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · meissner@suse.de (Secondary) |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | NVD · meissner@suse.de (Secondary) |
Advisories
- GHSA-xj7w-r753-vj8v — Exposure of vSphere's CPI and CSI credentials in Rancher
- GO-2024-3223 — Exposure of vSphere's CPI and CSI credentials in Rancher in github.com/rancher/rancher
European references
- ENISA EUVD · EUVD-2024-3170
- GCVE · GCVE-0-2022-45157
Affected products
| Product | Versions |
|---|---|
| SUSE · rancher | affected 2.9.0 < 2.9.3 ; affected 2.7.0 < 2.8.9 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |