CVE-2024-52284
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Summary
Unauthorized disclosure of sensitive data: Any user with GET or LIST permissions on BundleDeployment resources could retrieve Helm values containing credentials or other secrets.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SUSE | Rancher | 0.13.0 < 0.13.1-0.20250806151509-088bcbea7edb | affected |
| SUSE | Rancher | 0.12.0 < 0.12.6 | affected |
| SUSE | Rancher | 0.11.0 < 0.11.10 | affected |
Weaknesses
- CWE-312: CWE-312: Cleartext Storage of Sensitive Information
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284
- https://github.com/advisories/GHSA-6h9x-9j5v-7w9h
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.