CVE-2020-10684highobserved exploitationCWE-362CWE-862CWE-94

CVE-2020-10684: high-severity vulnerability in Red Hat Ansible

Published · Updated

Follow this CVE+ Monitor Ansible+ Monitor ansible

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 7.9epss 0.3%
from disclosure to weapon
Published on NVDMar 24
VulnCheck+1508d
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Affected products
Red Hat · Ansible
Related CVEs — Red Hat Ansible

In the same product, most dangerous first.

CVE-2016-8628HIGHCVE-2016-8628EPSS 3.2%CVE-2016-8614MEDIUMCVE-2016-8614EPSS 2.5%CVE-2019-14864MEDIUMCVE-2019-14864EPSS 1.9%CVE-2019-10217MEDIUMCVE-2019-10217EPSS 1.9%CVE-2019-10206MEDIUMCVE-2019-10206EPSS 1.5%CVE-2016-8647LOWCVE-2016-8647EPSS 1.4%