Skip to content
Fencer Vulns
medium 6.1

CVE-2019-13209 json

Rancher Vulnerable to Cross-site Request Forgery (CSRF)

published 2019-09-04 7 y ago modified 2026-09-10 1 mo ago also GHSA-xhg2-rvm8-w2jh , GO-2022-0755 , EUVD-2021-1233

cvss
6.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.

Patch / fix

  • go github.com/rancher/rancher 2.0.16, 2.1.11, 2.2.5, 2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatible

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/rancher/rancher
>=2.0.0, <2.0.16
>=2.1.0, <2.1.11
>=2.2.0, <2.2.5
<2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatible
2.0.16
2.1.11
2.2.5
2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatible

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.