CVE-2016-9587
38Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.6epss 18%
from disclosure to weapon0 days
Published on NVDApr 24
1st PoCJan 9
exploitation probability
18%top 3% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
unspecified · Ansiblepublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/41013unverifiedcve_referencewww.exploit-db.com/exploits/41013/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://rhn.redhat.com/errata/RHSA-2017-0195.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0260.htmlhttps://access.redhat.com/errata/RHSA-2017:0448https://access.redhat.com/errata/RHSA-2017:0515https://access.redhat.com/errata/RHSA-2017:1685https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587https://security.gentoo.org/glsa/201701-77https://www.exploit-db.com/exploits/41013/http://www.securityfocus.com/bid/95352