« Back to list

CVE-2024-22030

Status: DeferredHigh (8)—

A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

MITM contra dominio Rancher expirado permite interceptar credenciales (T1078) y manipular datos de configuración del cluster (T1565). T1557 como explotación por control de DNS/dominio.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

User TrainingNetwork SegmentationEncrypt Sensitive InformationApplication Developer GuidanceActive Directory ConfigurationUser Account Management

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Rancher — RancherAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-22030",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22030",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-16T14:23:02.642013Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "rancher",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.0",
              "lessThan": "2.7.15",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.8.0",
              "lessThan": "2.8.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.9.0",
              "lessThan": "2.9.2",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/rancher/rancher",
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:suse:rancher:-:*:*:*:*:*:*:*"
          ],
          "vendor": "suse",
          "product": "rancher",
          "versions": [
            {
              "status": "affected",
              "version": "2.7.0",
              "lessThan": "2.7.15",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.8.0",
              "lessThan": "2.8.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.9.0",
              "lessThan": "2.9.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-10-16T14:15:04.753",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22030",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4",
      "source": "meissner@suse.de"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified within Rancher that can be exploited\n in narrow circumstances through a man-in-the-middle (MITM) attack. An \nattacker would need to have control of an expired domain or execute a \nDNS spoofing/hijacking attack against the domain to exploit this \nvulnerability. The targeted domain is the one used as the Rancher URL."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en Rancher que puede explotarse en circunstancias específicas mediante un ataque de intermediario (MITM). Un atacante tendría que tener el control de un dominio vencido o ejecutar un ataque de suplantación de DNS o secuestro contra el dominio para explotar esta vulnerabilidad. El dominio objetivo es el que se utiliza como URL de Rancher."
    }
  ],
  "lastModified": "2026-06-17T07:10:34.557",
  "sourceIdentifier": "meissner@suse.de"
}