6.7
CVE-2021-20253
- EPSS 0.28%
- Published 09.03.2021 18:15:15
- Last modified 21.11.2024 05:46:13
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Ansible Tower Version < 3.6.7
Redhat ≫ Ansible Tower Version >= 3.7.0 < 3.7.5
Redhat ≫ Ansible Tower Version >= 3.8.0 < 3.8.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.28% | 0.482 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.7 | 0.8 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 3.5 | 1.5 | 6.4 |
AV:L/AC:H/Au:S/C:P/I:P/A:P
|
CWE-552 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.