CVE-2024-52282

Upstream information

CVE-2024-52282 at MITRE

Description

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET
access to the Rancher Manager Apps Catalog to read any sensitive information that are
contained within the Apps' values. Additionally, the same information
leaks into auditing logs when the audit level is set to equal or above
2.

This issue affects rancher: from 2.8.0 before 2.8.10, from 2.9.0 before 2.9.4.

---

Upstream Security Advisories:

• https://github.com/rancher/rancher/security/advisories/GHSA-9c5p-35gj-jqp4

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores

CVSS detail	CNA (SUSE)
Base Score	6.2
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Attack Vector	Network
Attack Complexity	Low
Privileges Required	High
User Interaction	Required
Scope	Changed
Confidentiality Impact	High
Integrity Impact	None
Availability Impact	None
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1233495 [RESOLVED / FIXED]

SUSE Security Advisories:

• GHSA-9c5p-35gj-jqp4, published Wed Nov 20 00:59:30 CET 2024
• openSUSE-SU-2024:14519-1, published Mon Nov 25 18:50:12 2024

List of released packages

Product(s)	Fixed package version(s)	References
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	less >= 633-3.1
SUSE Linux Enterprise Server 16.0	govulncheck-vulndb >= 0.0.20250814T182633-160000.1.2	Patchnames: SUSE Linux Enterprise Server 16.0 GA govulncheck-vulndb-0.0.20250814T182633-160000.1.2
openSUSE Tumbleweed	govulncheck-vulndb >= 0.0.20241121T195252-1.1	Patchnames: openSUSE-Tumbleweed-2024-14519

---

SUSE Timeline for this CVE

CVE page created: Tue Nov 19 13:45:34 2024
CVE page last modified: Sat Nov 8 22:01:48 2025