CVE Vulnerability

CVE-2019-11881

A vulnerability exists in Rancher 2.1.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malicious users to lure legitimate users to visit phishing sites with scare tactics, e.g., displaying a "This version of Rancher is outdated, please visit https://malicious.rancher.site/upgrading" message.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

4.7 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/rancher/rancher/issues/20216 Issue Tracking Exploit
https://github.com/MauroEldritch/VanCleef Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:suse:rancher:2.1.4:*:*:*:*:*:*:*
Information

Published : 2019-06-10 08:29

Updated : 2022-04-13 11:44

NVD link : CVE-2019-11881

Mitre link : CVE-2019-11881

Products Affected
No products.
CWE
NVD-CWE-noinfo