5
CVE-2020-1746
- EPSS 0.06%
- Published 12.05.2020 18:15:13
- Last modified 21.11.2024 05:11:17
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.
Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Ansible Engine Version >= 2.7.0 < 2.7.17
Redhat ≫ Ansible Engine Version >= 2.8.0 < 2.8.11
Redhat ≫ Ansible Engine Version >= 2.9.0 < 2.9.7
Redhat ≫ Ansible Tower Version >= 3.4.0 <= 3.4.5
Redhat ≫ Ansible Tower Version >= 3.5.0 <= 3.5.5
Redhat ≫ Ansible Tower Version >= 3.6.0 <= 3.6.3
Debian ≫ Debian Linux Version10.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.183 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5 | 1.3 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 1.9 | 3.4 | 2.9 |
AV:L/AC:M/Au:N/C:P/I:N/A:N
|
| secalert@redhat.com | 5 | 1.3 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.