Lucene search

[email protected]CVE-2021-20191

HistoryMay 26, 2021 - 9:15 p.m.

CVE-2021-20191

2021-05-2621:15:08

CWE-532

[email protected]

web.nvd.nist.gov

160

ansible

vulnerability

credentials

data confidentiality

cve-2021-20191

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.9

Confidence

High

EPSS

Percentile

15.6%

JSON

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

Affected configurations

Vulners

NVD

Node

ansibleansibleRange≤2.9.18

VendorProductVersionCPE
redhatansible*cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	ansible	*	cpe:2.3:a:redhat:ansible::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "ansible",
    "versions": [
      {
        "version": "ansible 2.9.18",
        "status": "affected"
      }
    ]
  }
]