| id: GO-2024-2534 |
| modules: |
| - module: github.com/rancher/apiserver |
| versions: |
| - fixed: 0.0.0-20240207153957-4fd7d821d952 |
| vulnerable_at: 0.0.0-20240206174200-14e7493da5d3 |
| packages: |
| - package: github.com/rancher/apiserver/pkg/writer |
| symbols: |
| - HTMLResponseWriter.write |
| derived_symbols: |
| - HTMLResponseWriter.Write |
| - HTMLResponseWriter.WriteList |
| - package: github.com/rancher/apiserver/pkg/urlbuilder |
| symbols: |
| - ParseRequestURL |
| derived_symbols: |
| - New |
| - NewPrefixed |
| summary: Unauthenticated cross-site scripting in github.com/rancher/apiserver |
| cves: |
| - CVE-2023-32192 |
| ghsas: |
| - GHSA-833m-37f7-jq55 |
| credits: |
| - diego95root |
| - kujalamathias |
| references: |
| - advisory: https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55 |
| - fix: https://github.com/rancher/apiserver/commit/4df268e250f625fa323349062636496e0aeff4e4 |
| - fix: https://github.com/rancher/apiserver/commit/4e102cf0d07b1af3d10d82c3e5a751a869b8a6c7 |
| - fix: https://github.com/rancher/apiserver/commit/4fd7d821d952510bfe38c9d4a3e2a65157f50525 |
| - fix: https://github.com/rancher/apiserver/commit/69b3c2b56f3fa5a421889c533dada8cd08783cda |
| - fix: https://github.com/rancher/apiserver/commit/97a10a30200cb851afd8ee85ee6b2295c4b6e5ee |
| - fix: https://github.com/rancher/apiserver/commit/a3b9e3721c1b558ee63aec9594e37c223a5c8437 |
