Vulnerability details

CVE-2024-52281

SUSE Rancher

Stored Cross-site Scripting vulnerability in Rancher UI

CVSS 3.1

8.9High

Official description

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.

CVSS scores

Score	Version	Source	Vector
8.9High	3.1	CVEProject cvelistV5 (CNA) (suse)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
SUSE	Rancher	2.9.0 ≤ v < 2.9.4	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-04-16
Last updated: 2026-02-26
State: Published
Assigner (CNA): suse

Exploit prediction (EPSS)

0.55%

Probability of exploitation in 30 days

46.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')