CVE-2015-1368

🗓️ 27 Jan 2015 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

Multiple XSS vulnerabilities in Ansible Tower before 2.0.5 allow remote script injection

Reporter	Title	Published	Views	Family All 5
CNVD	Multiple Cross-Site Scripting Vulnerabilities in Ansible Tower	14 Jan 201500:00	–	cnvd
Cvelist	CVE-2015-1368	27 Jan 201517:00	–	cvelist
EUVD	EUVD-2015-1507	7 Oct 202500:30	–	euvd
NVD	CVE-2015-1368	27 Jan 201520:04	–	nvd
Prion	Cross site scripting	27 Jan 201520:04	–	prion

NVD

Node

ansible towerRange≤2.0.2

Source	Link
sec-consult	www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt
osvdb	www.osvdb.org/show/osvdb/116962
osvdb	www.osvdb.org/show/osvdb/116964
seclists	www.seclists.org/fulldisclosure/2015/Jan/52
packetstormsecurity	www.packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html
securityfocus	www.securityfocus.com/bid/72023
exploit-db	www.exploit-db.com/exploits/35786
osvdb	www.osvdb.org/show/osvdb/116961
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/99924
securityfocus	www.securityfocus.com/archive/1/534464/100/0/threaded

Parameter	Position	Path	Description	CWE
order_by	query param	api/v1/credentials/	Cross-site scripting vulnerability via the order_by parameter in credentials endpoint.	CWE-79
order_by	query param	api/v1/inventories/	Cross-site scripting vulnerability via the order_by parameter in inventories endpoint.	CWE-79
order_by	query param	api/v1/projects/	Cross-site scripting vulnerability via the order_by parameter in projects endpoint.	CWE-79
order_by	query param	api/v1/users/3/permissions/	Cross-site scripting vulnerability via the order_by parameter in users/3/permissions endpoint.	CWE-79
next_run	query param	api/v1/schedules/	Cross-site scripting vulnerability via the next_run parameter in schedules endpoint.	CWE-79

06 May 2026 22:30Current

5.9Medium risk

Vulners AI Score5.9

CVSS 24.3

EPSS0.14008