CVEvulnerability

CVE-2020-1738

3.9 LOW Published 2020-03-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.9 LOW — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
CVSS 3.1 ([email protected])
3.9 LOW — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
CVSS 2.0 ([email protected])
2.6 LOW — AV:L/AC:H/Au:N/C:N/I:P/A:P
Weaknesses
CWE-88

Description

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Affected configurations

• redhat ansible (<= 2.7.16) • redhat ansible (>= 2.8.0 <= 2.8.8) • redhat ansible (>= 2.9.0 <= 2.9.5) • redhat ansible tower (<= 3.3.4) • redhat ansible tower (>= 3.3.5 <= 3.4.5) • redhat ansible tower (>= 3.5.0 <= 3.5.5) • redhat ansible tower (>= 3.6.0 <= 3.6.3) • redhat cloudforms management engine 5.0 • redhat openstack 13

Related

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References