CVE-2023-5764highCWE-1336

CVE-2023-5764: falha de alta gravidade em Red Hat Ansible Automation Platform 1.2

Ansible: template injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Ansible Automation Platform+ Monitorar ansible

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.6%
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Red Hat · Red Hat Ansible Automation Platform 1.2Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9
CVEs relacionadas — Red Hat Ansible Automation Platform 1.2

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2023-5115MEDIUMAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesEPSS 1.0%CVE-2023-5189MEDIUMHub: insecure galaxy-importer tarfile extractionEPSS 1.0%CVE-2023-3971HIGHController: html injection in custom login infoEPSS 0.8%CVE-2026-84474CRITICALAutomation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host matchEPSS 0.8%