CVE-2019-11881

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-11881
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11881.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-11881
Aliases
Published
2019-06-10T20:29:01.090Z
Modified
2026-07-08T18:17:58.769427Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to display arbitrary content, filtering tags but not special characters or symbols. There's no other limitation of the message, allowing malicious users to lure legitimate users to visit phishing sites with scare tactics, e.g., displaying a "This version of Rancher is outdated, please visit https://malicious.rancher.site/upgrading" message.

References

Affected packages

Git / github.com/rancher/rancher

Affected ranges

Type
GIT
Repo
https://github.com/rancher/rancher
Events
Introduced
444497330ac72112fb2fc0546bbee39b7f919f3e
Last affected
444497330ac72112fb2fc0546bbee39b7f919f3e
Fixed
e59adbc7565251919d84d6e353421104be8da06e
Database specific 
{
    "cpe": "cpe:2.3:a:suse:rancher:2.1.4:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.1.4"
        },
        {
            "last_affected": "2.1.4"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.1.4
v2.*
v2.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11881.json"