CVE-2024-22030CWE-295

Rancher agents can be hijacked by taking over the Rancher Server URL

High · published October 16, 2024

CVSS v3.1
8.0
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

A vulnerability has been identified within Rancher that can be exploited

in narrow circumstances through a man-in-the-middle (MITM) attack. An

attacker would need to have control of an expired domain or execute a

DNS spoofing/hijacking attack against the domain to exploit this

vulnerability. The targeted domain is the one used as the Rancher URL.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.5th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-10-16T13:24Z
EPSS history
Timeline
  • 16 OCT 13:24Z
    Rancher agents can be hijacked by taking over the Rancher Server URL
    cvelistv5