CVE-2016-9587mediumCWE-20

CVE-2016-9587: medium-severity vulnerability in Ansible

Published · Updated

Follow this CVE+ Monitor ansible+ Monitor ansible

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

38Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.6epss 17%
from disclosure to weaponsame day
Published on NVDApr 24
1st PoCJan 9
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
unspecified · Ansible
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.