CVE-2024-52281

HIGH 8.9

Stored Cross-site Scripting vulnerability in Rancher UI

CVSS Score

8.9

EPSS Score

0.0%

EPSS Percentile

0th

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.

CWE	CWE-79
Vendor	suse
Product	rancher
Published	Apr 16, 2025
Last Updated	Feb 26, 2026

Stay Ahead of the Next One

Get instant alerts for suse rancher

Be the first to know when new high vulnerabilities affecting suse rancher are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

SUSE / rancher

2.9.0 < 2.9.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.suse.com: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281 github.com: https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9

Credits

This issue was identified and reported by Bhavin Makwana from Workday’s Cyber Defence Team