« Volver al listado

CVE-2025-23387

Estado: AplazadaMedia (5.3)—

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Suse — RancherAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23387",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23387",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-11T13:27:25.277408Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "rancher",
          "versions": [
            {
              "status": "affected",
              "version": "2.8.0",
              "lessThan": "2.8.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.9.0",
              "lessThan": "2.9.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.10.0",
              "lessThan": "2.10.3",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/rancher/rancher",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-11T11:15:42.367",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-5qmp-9x47-92q8",
      "source": "meissner@suse.de"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de exposición de información confidencial a un actor no autorizado en SUSE Rancher permitía a usuarios no autenticados enumerar todos los tokens de autenticación de la CLI y eliminarlos antes de que la CLI pueda obtener el valor del token. Este problema afecta a Rancher: desde la versión 2.8.0 hasta la 2.8.13, desde la versión 2.9.0 hasta la 2.9.7, desde la versión 2.10.0 hasta la 2.10.3."
    }
  ],
  "lastModified": "2026-06-17T08:53:57.880",
  "sourceIdentifier": "meissner@suse.de"
}