CVE-2024-52280 json
Users can issue watch commands for arbitrary resources
published 2024-11-20 23 mo ago modified 2026-09-10 1 mo ago also GHSA-j5hq-5jcr-xwx7 , GO-2024-3281 , EUVD-2024-3361
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to access, when they have at least some generic permissions on the type. This issue affects rancher: before 2175e09, before 6e30359, before c744f0b.
Patch / fix
- go github.com/rancher/steve 0.0.0-20241029132712-2175e090fe4b
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20241121T195252-1.1
opensuse advisories openSUSE-SU-2024:14519-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/rancher/steve | <0.0.0-20241029132712-2175e090fe4b |
0.0.0-20241029132712-2175e090fe4b |
Affected products
- SUSE rancher
Classification
References
-
github.com
/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9
web, patch
-
bugzilla.suse.com
/show_bug.cgi?id=CVE-2024-52280
web
-
github.com
/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-52280
advisory
-
github.com
/rancher/steve
package
-
pkg.go.dev
/vuln/GO-2024-3281
web
Sources
- CVE List CVE-2024-52280
- GitHub Advisory GHSA-j5hq-5jcr-xwx7
- NVD CVE-2024-52280
- OSV GO-2024-3281
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.