CVE-2024-36110

2024-05-2819:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2024-36110

nvd

vulnerability

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

JSON

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.

Affected configurations

Vulners

Node

ansibleguywebuiRange<0.0.21

CNA Affected

[
  {
    "vendor": "ansibleguy",
    "product": "webui",
    "versions": [
      {
        "version": "< 0.0.21",
        "status": "affected"
      }
    ]
  }
]