Exposure of RabbitMQ Management Interface in Ansible Tower

CVE-2019-19340

Summary

A security misconfiguration was identified in Ansible Tower, affecting versions 3.6.x prior to 3.6.2 and 3.5.x prior to 3.5.3. When the RabbitMQ management interface is enabled using the flag '-e rabbitmq_enable_manager=true', it becomes exposed to the public. If the default admin account remains active, it presents an opportunity for attackers to exploit weak or guessed passwords, potentially allowing unauthorized access to the system.

References