Description
A vulnerability has been identified in which unauthenticated cross-site
scripting (XSS) in Norman's public API endpoint can be exploited. This
can lead to an attacker exploiting the vulnerability to trigger
JavaScript code and execute commands remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SUSE | norman | < 0.0.0-20240207153100-3bb70b772b52 | 0.0.0-20240207153100-3bb70b772b52 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rancher/norman | < 0.0.0-20240207153100-3bb70b772b52 | 0.0.0-20240207153100-3bb70b772b52 | GHSA-r8f4-hv23-6qp6 |
Advisories 1
- WID-SEC-2024-0332 Rancher: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 8, 2024