Ansible Automation Platform vulnerability

CVE-2024-9620

Summary

A critical flaw exists in the Event-Driven Automation (EDA) component of the Ansible Automation Platform, whereby sensitive information is transmitted and stored without encryption. This vulnerability exposes plaintext data to attackers with network access, who could intercept unprotected communications between the EDA and AAP. Additionally, attackers with system access could gain access to sensitive information stored in the EDA and AAP databases, further compromising data integrity. Organizations leveraging this platform should take immediate steps to mitigate the risk associated with this vulnerability to safeguard their sensitive information.

References