CVE-2022-43760

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page. This issue affects Rancher: from >= 2.6.0 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

• CWE-79

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-43760Issue Tracking, Vendor Advisory
• https://github.com/rancher/rancher/security/advisories/GHSA-46v3-ggjg-qq3xVendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-43760Issue Tracking, Vendor Advisory
• https://github.com/rancher/rancher/security/advisories/GHSA-46v3-ggjg-qq3xVendor Advisory

Published

Jun 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-43755A Insufficient Entropy vulnerability in SUSE Rancher allows …9.8
• CVE-2022-43756A Improper Neutralization of Special Elements in Output Used…7.5
• CVE-2022-43757A Cleartext Storage of Sensitive Information vulnerability i…8.8
• CVE-2022-43758A Improper Neutralization of Special Elements used in an OS …6.8
• CVE-2022-43759A Improper Privilege Management vulnerability in SUSE Ranche…8.8
• CVE-2022-4376An issue has been discovered in GitLab affecting all version…4.3
• CVE-2022-43761Missing authentication when creating and managing the B&R AP…7.5
• CVE-2022-43762 Lack of verification in B&R APROL Tbase server versions < R…9.8
• CVE-2022-43763Insufficient check of preconditions could lead to Denial of …7.5
• CVE-2022-43764Insufficient validation of input parameters when changing co…9.8
• CVE-2022-43765B&R APROL versions < R 4.2-07 doesn’t process correctly spec…7.5
• CVE-2022-43766Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are …7.5