CVE-2025-23387CWE-200

Rancher's SAML-based login via CLI can be denied by unauthenticated users

Medium · published April 11, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
47.6
In the wild
Unconfirmed
What it is

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00592 · 47.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-04-11T10:52Z
EPSS history
Timeline
  • 11 APR 10:52Z
    Rancher's SAML-based login via CLI can be denied by unauthenticated users
    cvelistv5