Platform: token exposed at importing project
CVE-2023-4380

6.3MEDIUM

Key Information:

Vendor
Red Hat
Status
Red Hat Ansible Automation Platform 2.4 For Rhel 8
Red Hat Ansible Automation Platform 2.4 For Rhel 9
Vendor
CVE Published:
4 October 2023

Summary

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Affected Version(s)

Red Hat Ansible Automation Platform 2.4 for RHEL 8 0:1.0.1-1.el8ap

Red Hat Ansible Automation Platform 2.4 for RHEL 9 0:1.0.1-1.el9ap

References

https://access.redhat.com/errata/RHSA-2023:4693
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-4380
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2232324
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.