Skip to main content

Cleartext Storage of Sensitive Information

CVE-2024-52284

High
7.7/10

Summary

A Sensitive Data Exposure vulnerability exists in Rancher Fleet. The vulnerability arises from the handling of Helm values specified in "BundleDeployment.Spec.Options.Helm.Values". These values, which may include credentials or other sensitive information, are stored in plain text within the Kubernetes resource "BundleDeployment". This issue affects github.com/rancher/fleet versions 0.11.0-beta.1 through 0.11.9, 0.12.0-alpha.0 through 0.12.5, and 0.13.0-alpha.1 through 0.13.1-beta.2.

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-312 - Cleartext Storage of Sensitive Information

The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References

Advisory Timeline

  • Published