CVE-2022-43758CWE-78

Rancher: Command injection in Git package

High · published February 7, 2023

CVSS v3.1
7.6
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00981 · 61.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2023-02-07T00:00Z
EPSS history
Timeline
  • 07 FEB 00:00Z
    Rancher: Command injection in Git package
    cvelistv5