CVEvulnerability

CVE-2021-3583

7.1 HIGH Published 2021-09-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-09-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-20, CWE-94

Description

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

Affected configurations

• redhat ansible automation platform 1.2 • redhat ansible engine (< 2.9.23) • redhat ansible tower (< 3.7.0)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References