CVE-2019-11202
First published: Tue Jul 30 2019(Updated: )
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SUSE Rancher | >=2.0.0<=2.0.13 | |
| SUSE Rancher | >=2.1.0<=2.1.8 | |
| SUSE Rancher | >=2.2.0<=2.2.1 | |
| go/github.com/rancher/rancher | >=2.2.0<2.2.2 | 2.2.2 |
| go/github.com/rancher/rancher | >=2.1.0<=2.1.8 | |
| go/github.com/rancher/rancher | >=2.0.0<=2.0.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://forums.rancher.com/c/announcements
- https://rancher.com/docs/rancher/v2.x/en/security/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11202
- https://forums.rancher.com/t/rancher-release-v2-2-2-addresses-rancher-cve-2019-11202-and-stability-issues/13977
- https://github.com/advisories/GHSA-xh8x-j8h3-m5ph (Advisory)
- https://pkg.go.dev/vuln/GO-2024-2784
Frequently Asked Questions
What versions of Rancher are affected by CVE-2019-11202?
The following versions of Rancher are affected by CVE-2019-11202: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1.
What is the severity of CVE-2019-11202?
CVE-2019-11202 has a severity rating of 9.8 (Critical).
How does CVE-2019-11202 impact Rancher?
CVE-2019-11202 allows for the creation of a default admin user with a well-known password during the initial setup of Rancher.
How can I fix CVE-2019-11202 in Rancher?
To fix CVE-2019-11202 in Rancher, it is recommended to update to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2019-11202?
More information about CVE-2019-11202 can be found on the Rancher forums and the official Rancher documentation.
- collector/nvd-index
- agent/type
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-xh8x-j8h3-m5ph
- alias/CVE-2019-11202
- agent/references
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/suse
- canonical/suse rancher
- version/suse rancher/2.0.0
- version/suse rancher/2.0.13
- version/suse rancher/2.1.0
- version/suse rancher/2.1.8
- version/suse rancher/2.2.0
- version/suse rancher/2.2.1
- package-manager/go