CVE-2019-11202
highPriorität · verfolgen · 40EPSS 0.016 · 76. PerzentilEUUSEPSS · bewertet 2026-10-27
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (8)
Betroffene Produkte und Versionsbereiche.
- Go github.com/rancher/rancher2.0.0+incompatible → 2.2.2+incompatibleosvUSpkg:golang/github.com/rancher/rancher
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-xh8x-j8h3-m5phRancher Recreates Default User With Known Password Despite Deletion2022-05-24ghsa · osvUS
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
- GO-2024-2784Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher2024-06-10vendor · osvUS
Rancher Recreates Default User With Known Password Despite Deletion in github.com/rancher/rancher
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://forums.rancher.com/c/announcementscnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-11202cnnvd
- https://rancher.com/docs/rancher/v2.x/en/security/cnnvd
- https://forums.rancher.com/c/announcementsenisa_euvd
- https://rancher.com/docs/rancher/v2.x/en/security/enisa_euvd
- https://forums.rancher.com/c/announcementsRelease NotesVendor Advisorynvd
- https://rancher.com/docs/rancher/v2.x/en/security/Vendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan