{"id":"CVE-2024-52281","aliases":["GHSA-2v2w-8v8c-wcm9","GO-2025-3391"],"title":"Rancher UI has Stored Cross-site Scripting vulnerability","summary":"Rancher UI has Stored Cross-site Scripting vulnerability","severity":"high","cvss":8.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","vendor":"rancher","product":"github.com/rancher/rancher","ecosystem":"go","affected":["github.com/rancher/rancher >= 2.9.0, < 2.9.4"],"patched":["github.com/rancher/rancher 2.9.4"],"published":"2025-01-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:21.767119104Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2v2w-8v8c-wcm9","references":[{"url":"https://github.com/rancher/rancher/security/advisories/GHSA-2v2w-8v8c-wcm9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52281"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52281"},{"url":"https://github.com/rancher/rancher"}],"tags":["osv","go"],"epss":0.00545,"epssPercentile":0.44631,"ingestedAt":"2026-09-12T03:13:01.746Z","slug":"CVE-2024-52281","body":"## Overview\n\n### Impact\nA vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field.\n\nPlease consult the associated  [MITRE ATT&CK - Technique - Drive-by Compromise](https://attack.mitre.org/techniques/T1189/) for further information about this category of attack.\n\n### Patches\nThe fix introduces new changes in the directives responsible for sanitizing HTML code before rendering. \n\nWe replaced the `v-tooltip` directive with the `v-clean-tooltip` directive.\n\nPatched versions include releases `2.9.4` and `2.10.0`.\n\n### Workarounds\nThere are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of /Rancher Manager which contains the fixes.\n\n### Credits\nThis issue was identified and reported by Bhavin Makwana from Workday’s Cyber Defence Team.\n\n### For more information\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).\n\n## Affected packages\n\n- `github.com/rancher/rancher >= 2.9.0, < 2.9.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/rancher/rancher 2.9.4`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":49,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}