{"vulnerability": "CVE-2023-22649", "sightings": [{"uuid": "9b4a53e6-81be-4033-9f6c-c180c62202ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "802034bf-ac86-418a-a037-d8d3519c764d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:51.000000Z"}, {"uuid": "90d262f7-0c0f-4f03-94d7-7570ab4c1374", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:00.000000Z"}, {"uuid": "3274f378-7343-4546-bbdd-64a39f7c653d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/linux/gather/rancher_audit_log_leak.rb", "content": "", "creation_timestamp": "2024-04-10T16:08:23.000000Z"}, {"uuid": "afa2ea91-5bda-425e-8f2a-6f0190da2e51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "https://t.me/cvedetector/8035", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2023-22649 - Rancher Audit Logging Sensitive Data Disclosure Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2023-22649 \nPublished : Oct. 16, 2024, 8:15 a.m. | 37\u00a0minutes ago \nDescription : A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging]() is an opt-in feature, only deployments that have it enabled and have [AUDIT_LEVEL]() set to `1 or above` are impacted by this issue. \nSeverity: 8.4 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-16T11:20:50.000000Z"}, {"uuid": "14255b33-656f-43d8-bddf-31ea78bb1e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqsaom63ky2s", "content": "\ud83d\udccc CVE-2023-22649 - A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://rancherma... https://www.cyberhub.blog/cves/CVE-2023-22649", "creation_timestamp": "2026-07-16T22:07:07.767013Z"}, {"uuid": "00978d8b-f275-476f-8a05-1d8ed2d00bfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22649", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/linux/gather/rancher_audit_log_leak.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"h00die\"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": false, \"default_credential\": false, \"description\": \"Rancher versions between 2.6.0-2.6.13, 2.7.0-2.7.9, 2.8.0-2.8.1 inclusive\\n          contain a vulnerability where sensitive data is leaked into the audit logs.\\n          Rancher Audit Logging is an opt-in feature, only deployments that have it\\n          enabled and have AUDIT_LEVEL set to 1 or above are impacted by this issue.\\n\\n          Tested against rancher 2.6.0.\", \"disclosure_date\": \"2024-02-08\", \"fullname\": \"post/linux/gather/rancher_audit_log_leak\", \"is_install_path\": true, \"mod_time\": \"2026-02-09 15:17:23 +0000\", \"name\": \"Rancher Audit Log Sensitive Information Leak\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/post/linux/gather/rancher_audit_log_leak.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"linux/gather/rancher_audit_log_leak\", \"references\": [\"GHSA-xfj7-qf8w-2gcr\", \"URL-https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#api-audit-log-options\", \"CVE-2023-22649\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:41.188457Z"}]}