CVE-2022-31249
Assigner: suse
Published: 2023-02-07T00:00:00
State: PUBLISHED
title: [RANCHER] OS command injection in Rancher and Fleet
datePublic: 2023-01-25T00:00:00
descriptions: value: A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.
affected: vendor: SUSE
product: Rancher
versions: version: wrangler
status: affected
lessThanOrEqual: 0.7.3
versionType: custom
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
problemTypes: descriptions: type: CWE
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cweId: CWE-78
x_generator: engine: Vulnogram 0.0.9
source: advisory: https://bugzilla.suse.com/show_bug.cgi?id=1200299
defect: 1200299
discovery: INTERNAL