{"id":"CVE-2024-52281","aliases":["EUVD-2025-0078","GHSA-2v2w-8v8c-wcm9","GO-2025-3391","SUSE-SU-2025:0297-1","openSUSE-SU-2025:14653-1"],"status":"published","title":"Stored Cross-site Scripting vulnerability in Rancher UI","description":"A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.","severity":{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00566,"percentile":0.47306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-01-14T22:03:33Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Go","package":"github.com/rancher/rancher","fixed_in":["2.9.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.0"},{"fixed":"2.9.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rancher/rancher","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250128T150132-150000.1.29.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250115T172141-1.1"}]}],"bundled":5}],"products":[{"vendor":"suse","product":"rancher"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281","tags":["report","web"]},{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9","tags":["advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52281","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2v2w-8v8c-wcm9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52281.json","tags":["advisory"]},{"url":"https://github.com/rancher/rancher","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-20621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24355","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3ISCFQBRATG2LAA3K5XNETXSCP77AAKA/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-52281","title":"Stored Cross-site Scripting vulnerability in Rancher UI","description":"A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.","status":"published","published":"2025-04-16T08:31:11.378Z","modified":"2026-02-26T18:28:14.954Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2025-0078","description":"A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.","status":"published","published":"2025-04-16T08:31:11Z","modified":"2026-02-26T18:28:14Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:17.446722Z"}],"ghsa":[{"id":"GHSA-2v2w-8v8c-wcm9","title":"Rancher UI has Stored Cross-site Scripting vulnerability","description":"### Impact\nA vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field.\n\nPlease consult the associated  [MITRE ATT\u0026CK - Technique - Drive-by Compromise](https://attack.mitre.org/techniques/T1189/) for further information about this category of attack.\n\n### Patches\nThe fix introduces new changes in the directives responsible for sanitizing HTML code before rendering. \n\nWe replaced the `v-tooltip` directive with the `v-clean-tooltip` directive.\n\nPatched versions include releases `2.9.4` and `2.10.0`.\n\n### Workarounds\nThere are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of /Rancher Manager which contains the fixes.\n\n### Credits\nThis issue was identified and reported by Bhavin Makwana from Workday’s Cyber Defence Team.\n\n### For more information\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).","status":"published","published":"2025-01-14T22:03:33Z","modified":"2025-04-16T14:30:35Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2024-52281","description":"A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.","status":"published","published":"2025-04-16T09:15:27.62Z","modified":"2026-06-17T08:06:55.997Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-52281","title":"Stored Cross-site Scripting vulnerability in Rancher UI","description":"A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.","status":"published","published":"2025-04-16T08:31:11.378Z","modified":"2026-10-28T02:30:30.482747623Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-2v2w-8v8c-wcm9","title":"Rancher UI has Stored Cross-site Scripting vulnerability","description":"### Impact\nA vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field.\n\nPlease consult the associated  [MITRE ATT\u0026CK - Technique - Drive-by Compromise](https://attack.mitre.org/techniques/T1189/) for further information about this category of attack.\n\n### Patches\nThe fix introduces new changes in the directives responsible for sanitizing HTML code before rendering. \n\nWe replaced the `v-tooltip` directive with the `v-clean-tooltip` directive.\n\nPatched versions include releases `2.9.4` and `2.10.0`.\n\n### Workarounds\nThere are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of /Rancher Manager which contains the fixes.\n\n### Credits\nThis issue was identified and reported by Bhavin Makwana from Workday’s Cyber Defence Team.\n\n### For more information\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).","status":"published","published":"2025-01-14T22:03:33Z","modified":"2026-09-10T03:50:21.767119104Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"GO-2025-3391","title":"Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher","description":"Rancher UI has Stored Cross-site Scripting vulnerability in github.com/rancher/rancher.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/rancher/rancher from v2.9.0 before v2.9.4.","status":"published","published":"2025-01-15T15:20:27Z","modified":"2026-07-02T16:59:26.468172108Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14653-1","title":"govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250115T172141-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-16T00:00:00Z","modified":"2026-02-04T03:45:57.259345Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0297-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n  * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n  * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n  * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n  * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n  * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n  * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n  * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n  * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3372 CVE-2024-45339\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n  * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n  * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n  * GO-2025-3396 CVE-2024-52594\n  * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n  * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n  * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n  * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n  * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n  * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n  * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n  * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n  * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n  * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n  * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n  * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n  * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n","status":"published","published":"2025-01-30T14:03:37Z","modified":"2026-02-05T11:21:44.836869Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}