5.3

CVE-2025-5988

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://gitlab.cee.redhat.com/ansible/aap-gateway/
≫
Package automation-gateway-server
Default Statusunaffected
Version < 2.5.20250730
Version 0
Status affected
VendorRed Hat
≫
Product Red Hat Ansible Automation Platform 2.5 for RHEL 8
Default Statusaffected
Version < *
Version 0:2.5.20250730-2.el8ap
Status unaffected
VendorRed Hat
≫
Product Red Hat Ansible Automation Platform 2.5 for RHEL 9
Default Statusaffected
Version < *
Version 0:2.5.20250730-2.el9ap
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.032
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secalert@redhat.com 5.3 1.6 3.6
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.