{"id":"EUVD-2023-1680","revision":"07937e14e9e44848a0cb08c4178436ff","records":[{"revision":"07937e14e9e44848a0cb08c4178436ff","observedAt":"2026-10-24T21:27:17.261+00:00","statement":{"source":"euvd","id":"EUVD-2023-1680","aliases":["CVE-2022-43760","GHSA-46v3-ggjg-qq3x"],"title":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is ","description":"An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is \nexecuted within another user's browser, allowing the attacker to steal \nsensitive information, manipulate web content, or perform other \nmalicious activities on behalf of the victims. This could result in a \nuser with write access to the affected areas being able to act on behalf\n of an administrator, once an administrator opens the affected web page.\n\n\nThis issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.\n\n","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","score":8.4,"severity":null}],"references":["https://github.com/rancher/rancher/security/advisories/GHSA-46v3-ggjg-qq3x","https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-43760"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1680","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 1, 2023, 12:56:40 PM","dateUpdated":"Jan 9, 2025, 4:58:33 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2023-1340","title":"Rancher: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2023-22648","CVE-2023-22647","CVE-2022-43760","CVE-2020-10676"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2023-1680","identifiers":["EUVD-2023-1680","CVE-2022-43760","GHSA-46v3-ggjg-qq3x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}