CVE-2025-23387

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-23387
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387
https://github.com/rancher/rancher/security/advisories/GHSA-5qmp-9x47-92q8
Configurations

No configuration.

History

11 Apr 2025, 15:39

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de exposición de información confidencial a un actor no autorizado en SUSE Rancher permitía a usuarios no autenticados enumerar todos los tokens de autenticación de la CLI y eliminarlos antes de que la CLI pueda obtener el valor del token. Este problema afecta a Rancher: desde la versión 2.8.0 hasta la 2.8.13, desde la versión 2.9.0 hasta la 2.9.7, desde la versión 2.10.0 hasta la 2.10.3.

11 Apr 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-11 11:15

Updated : 2025-04-11 15:39

NVD link : CVE-2025-23387

Mitre link : CVE-2025-23387

CVE.ORG link : CVE-2025-23387

JSON object : View

Products Affected

No product.

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor