CVE-2022-21947
Assigner: suse
Published: 2022-04-01T00:00:00
State: PUBLISHED
title: rancher desktop: Dashboard API is network accessible
datePublic: 2022-03-25T00:00:00
descriptions: value: A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.
affected: vendor: SUSE
product: Rancher
versions: version: Desktop
status: affected
lessThan: V
versionType: custom
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-668: Exposure of Resource to Wrong Sphere
cweId: CWE-668
x_generator: engine: Vulnogram 0.0.9
source: advisory: https://bugzilla.suse.com/show_bug.cgi?id=1197491
defect: 1197491
discovery: INTERNAL