CVE-2022-43760

{
  "id": "CVE-2022-43760",
  "sourceIdentifier": "[email protected]",
  "published": "2023-06-01T13:15:10.373",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is \nexecuted within another user's browser, allowing the attacker to steal \nsensitive information, manipulate web content, or perform other \nmalicious activities on behalf of the victims. This could result in a \nuser with write access to the affected areas being able to act on behalf\n of an administrator, once an administrator opens the affected web page.\n\n\nThis issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.\n\n"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Neutralización Inadecuada de Entrada Durante la Generación de Páginas Web ('Cross-site Scripting') en SUSE Rancher permite a usuarios en algunos grupos con mayores privilegios inyectar código que se ejecuta dentro del navegador de otro usuario, permitiendo al atacante robar información sensible, manipular contenido web, o realizar otras actividades maliciosas en nombre de las víctimas. Esto podría resultar en que un usuario con acceso de escritura a las áreas afectadas pueda actuar en nombre de un administrador, una vez que un administrador abra la página web afectada.\n\nEste problema afecta a Rancher: desde >= 2.6.0 antes de anterior a 2.6.13, desde >= 2.7.0 antes de anterior a 2.7.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "Rancher",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": ">= 2.6.0",
              "lessThan": "< 2.6.13",
              "versionType": "2.6.13",
              "status": "affected"
            },
            {
              "version": ">= 2.7.0",
              "lessThan": "< 2.7.4",
              "versionType": "2.7.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 6.0
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-01-09T16:58:17.163134Z",
          "id": "CVE-2022-43760",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.6.0",
              "versionEndExcluding": "2.6.13",
              "matchCriteriaId": "1E9E01CC-9BB4-4A69-8F2D-ECCA9CF59580"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.7.0",
              "versionEndExcluding": "2.7.4",
              "matchCriteriaId": "82B60ABA-3389-45F0-9F45-4D4D0D4738BC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-43760",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-46v3-ggjg-qq3x",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-43760",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-46v3-ggjg-qq3x",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}