TI-2022-21494 Aliases CVE-2022-43760 GHSA-46v3-ggjg-qq3x

Cross-site scripting in SUSE Rancher

MEDIUM 40CWE-79Published 2023-06-01 · Updated 2025-01-09

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00714 53rd percentileScored 2026-11-07

Fix Fixed Rancher (SUSE): < 2.6.13, < 2.7.4github.com/rancher/rancher (Go): 2.6.13, 2.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SUSE	Rancher	>= 2.6.0 to before < 2.6.13; >= 2.7.0 to before < 2.7.4	< 2.6.13, < 2.7.4	Patch available	CNA
—	github.com/rancher/rancher (Go)	2.6.0 to before 2.6.13	2.6.13	Patch available	GHSA-46v3-ggjg-qq3x
—	github.com/rancher/rancher (Go)	2.7.0 to before 2.7.4	2.7.4	Patch available	GHSA-46v3-ggjg-qq3x

Rancher VendorSUSE Affected >= 2.6.0 to before < 2.6.13; >= 2.7.0 to before < 2.7.4 Fixed in < 2.6.13, < 2.7.4 Patch available CNA
github.com/rancher/rancher (Go) Vendor— Affected 2.6.0 to before 2.6.13 Fixed in 2.6.13 Patch available GHSA-46v3-ggjg-qq3x
github.com/rancher/rancher (Go) Vendor— Affected 2.7.0 to before 2.7.4 Fixed in 2.7.4 Patch available GHSA-46v3-ggjg-qq3x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:suse:rancher::::::::	2.6.0 to before 2.6.13; 2.7.0 to before 2.7.4	Vulnerable	SUSE

cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.6.13; 2.7.0 to before 2.7.4 Vulnerable ·SUSE

Remediation

Fix · CNA Rancher (SUSE) Fixed in < 2.6.13, < 2.7.4
Fix · GHSA-46v3-ggjg-qq3x github.com/rancher/rancher (Go) Fixed in 2.6.13 Advisory →
Fix · GHSA-46v3-ggjg-qq3x github.com/rancher/rancher (Go) Fixed in 2.7.4 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-06-01
SUSE Rancher < 2.6.13, < 2.7.4
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-08823 Improper privilege management in SUSE RancherPriority MEDIUM 44
- TI-2023-08824 Improper privilege management in SUSE RancherPriority LOW 38
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-43760
2026-10-03 Alias added: GHSA-46v3-ggjg-qq3x

References

Advisory 3

Other 3

TI-2021-14903 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object CVSS 3.1CRITICAL 9.9
TI-2022-21489 Rancher: Non-random authentication token CVSS 3.1CRITICAL 9.8
TI-2019-08380 An issue was discovered that affects the following versions of Rancher: v2.0.0 through… CVSS 3.0CRITICAL 9.8
TI-2023-08827 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2023-08823 Improper privilege management in SUSE Rancher CVSS 3.1CRITICAL 9.9
TI-2022-21491 Rancher: Exposure of sensitive fields CVSS 3.1CRITICAL 9.9

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences