CVE-2025-23387

{"id": "CVE-2025-23387", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2025-04-11T11:15:42.367", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-23387", "source": "meissner@suse.de"}, {"url": "https://github.com/rancher/rancher/security/advisories/GHSA-5qmp-9x47-92q8", "source": "meissner@suse.de"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens and delete them before the CLI is able to get the token value.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 before 2.9.7, from 2.10.0 before 2.10.3."}, {"lang": "es", "value": "Una vulnerabilidad de exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado en SUSE Rancher permit\u00eda a usuarios no autenticados enumerar todos los tokens de autenticaci\u00f3n de la CLI y eliminarlos antes de que la CLI pueda obtener el valor del token. Este problema afecta a Rancher: desde la versi\u00f3n 2.8.0 hasta la 2.8.13, desde la versi\u00f3n 2.9.0 hasta la 2.9.7, desde la versi\u00f3n 2.10.0 hasta la 2.10.3."}], "lastModified": "2025-04-11T15:39:52.920", "sourceIdentifier": "meissner@suse.de"}