7.8

CVE-2018-10874

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Ansible Engine Version2.0
Redhat ≫ Ansible Engine Version2.4
Redhat ≫ Ansible Engine Version2.5
Redhat ≫ Ansible Engine Version2.6
Redhat ≫ Openstack Version10
Redhat ≫ Openstack Version12
Redhat ≫ Openstack Version13
Redhat ≫ Virtualization Version4.0
Redhat ≫ Virtualization Host Version4.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.06% 0.191
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
secalert@redhat.com 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

http://www.securitytracker.com/id/1041396
Third Party Advisory
VDB Entry