CVE-2024-52284 - Vulnerability Details - OpenCVE

Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Suse	Rancher

No data.

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284
https://github.com/advisories/GHSA-6h9x-9j5v-7w9h

History

Wed, 03 Sep 2025 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Suse Suse rancher
Vendors & Products		Suse Suse rancher

Tue, 02 Sep 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 02 Sep 2025 12:00:00 +0000

Type	Values Removed	Values Added
Description		Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.
Title		Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
Weaknesses		CWE-312
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284 https://github.com/advisories/GHSA-6h9x-9j5v-7w9h
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2025-09-02T11:49:49.379Z

Updated: 2025-09-02T13:31:49.988Z

Reserved: 2024-11-06T12:19:57.723Z

Link: CVE-2024-52284

Vulnrichment

Updated: 2025-09-02T13:31:47.561Z

NVD

Status : Awaiting Analysis

Published: 2025-09-02T12:15:35.443

Modified: 2025-09-02T15:55:25.420

Link: CVE-2024-52284

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52284", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2024-11-06T12:19:57.723Z", "datePublished": "2025-09-02T11:49:49.379Z", "dateUpdated": "2025-09-02T13:31:49.988Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "github.com/rancher/fleet", "product": "Rancher", "vendor": "SUSE", "versions": [{"lessThan": "0.13.1-0.20250806151509-088bcbea7edb", "status": "affected", "version": "0.13.0", "versionType": "semver"}, {"lessThan": "0.12.6", "status": "affected", "version": "0.12.0", "versionType": "semver"}, {"lessThan": "0.11.10", "status": "affected", "version": "0.11.0", "versionType": "semver"}]}], "datePublic": "2025-08-29T12:31:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets."}], "value": "Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2025-09-02T11:50:55.874Z"}, "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284"}, {"url": "https://github.com/advisories/GHSA-6h9x-9j5v-7w9h"}], "source": {"discovery": "UNKNOWN"}, "title": "Rancher Fleet Helm Values are stored inside BundleDeployment in plain text", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T13:31:45.987374Z", "id": "CVE-2024-52284", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T13:31:49.988Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T13:31:45.987374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T13:31:47.561Z"}}], "cna": {"title": "Rancher Fleet Helm Values are stored inside BundleDeployment in plain text", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "Rancher", "versions": [{"status": "affected", "version": "0.13.0", "lessThan": "0.13.1-0.20250806151509-088bcbea7edb", "versionType": "semver"}, {"status": "affected", "version": "0.12.0", "lessThan": "0.12.6", "versionType": "semver"}, {"status": "affected", "version": "0.11.0", "lessThan": "0.11.10", "versionType": "semver"}], "packageName": "github.com/rancher/fleet", "defaultStatus": "unaffected"}], "datePublic": "2025-08-29T12:31:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52284"}, {"url": "https://github.com/advisories/GHSA-6h9x-9j5v-7w9h"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.", "supportingMedia": [{"type": "text/html", "value": "Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2025-09-02T11:50:55.874Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52284", "state": "PUBLISHED", "dateUpdated": "2025-09-02T13:31:49.988Z", "dateReserved": "2024-11-06T12:19:57.723Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2025-09-02T11:49:49.379Z", "assignerShortName": "suse"}, "dataVersion": "5.1"}