CVEvulnerability
CVE-2018-1101
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-05-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-266, CWE-521
Description
Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.
Affected configurations
• redhat ansible tower (< 3.2.4)
• redhat cloudforms 4.5
• redhat cloudforms 4.6
Related
References
- https://access.redhat.com/errata/RHSA-2018:1328 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1972 Third Party Advisory
- https://access.redhat.com/security/cve/cve-2018-1101 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1563492 Issue Tracking, Third Party Advisory
- https://www.ansible.com/security Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1328 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:1972 Third Party Advisory
- https://access.redhat.com/security/cve/cve-2018-1101 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1563492 Issue Tracking, Third Party Advisory
- https://www.ansible.com/security Vendor Advisory