CVE-2022-21951CWE-319

Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden

Medium · published May 25, 2022

CVSS v3.1
6.8
EPSS
0%
Percentile
32.4
In the wild
Unconfirmed
What it is

A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.4th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2022-05-25T08:15Z
EPSS history
Timeline
  • 25 MAY 08:15Z
    Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden
    cvelistv5