CVE-2021-25313 in Rancher and Suse Products
Published on March 5, 2021

Rancher: XSS on /v3/cluster/

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.

NVD

Vulnerability Analysis

CVE-2021-25313 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2021-25313 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2021-25313

stack.watch emails you whenever new vulnerabilities are published in Rancher or Suse Rancher. Just hit a watch button to start following.

Rancher

Suse Rancher

Affected Versions

SUSE Rancher:

Version Rancher and below 2.5.6 is affected.

Exploit Probability

EPSS

0.65%

Percentile

70.34%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.