6.7
CVE-2021-20253
- EPSS 0.28%
- Veröffentlicht 09.03.2021 18:15:15
- Zuletzt bearbeitet 21.11.2024 05:46:13
- Quelle secalert@redhat.com
- Teams Watchlist Login
- Unerledigt Login
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Ansible Tower Version < 3.6.7
Redhat ≫ Ansible Tower Version >= 3.7.0 < 3.7.5
Redhat ≫ Ansible Tower Version >= 3.8.0 < 3.8.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.28% | 0.482 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.7 | 0.8 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 3.5 | 1.5 | 6.4 |
AV:L/AC:H/Au:S/C:P/I:P/A:P
|
CWE-552 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.