CVE-2019-11202 - CVE House
Back to Database
Status published Critical CVE-2019-11202

An issue was discovered that affects the following versions of...

Vulnerability Description

An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11202

Credits & Attribution

No credits recorded in the NVD database.

References

More from suse

View All →
CVE-2020-10676
In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an...
High 8.8
CVE-2019-6287
In Rancher 2.0.0 through 2.1.5, project members have continued access...
High 8.1
CVE-2019-13209
Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket...
Medium 6.1
CVE-2019-12303
In Rancher 2 through 2.2.3, Project owners can inject additional...
High 8.8
CVE-2019-12274
In Rancher 1 and 2 through 2.2.3, unprivileged users (if...
High 8.8

Affected Vendor

Affected Software

rancher
Vulnerable Versions:
2.0.0, 2.1.0, 2.2.0

Timeline

Official Publish: July 30th, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.