CVE-2021-36778

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-367799.6A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary prese CVE-2021-36785.9showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)CVE-2021-367808.1A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine r CVE-2021-367814.4A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leadin CVE-2021-367829.9A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Own CVE-2021-367839.9A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners an CVE-2021-367847.2A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This is CVE-2021-367855.4The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.CVE-2021-367867.5The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private key CVE-2021-367875.4The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.CVE-2021-367885.4The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.CVE-2021-367899.8The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.