RedhatCVELIST:CVE-2018-16879CVE-2018-16879
7.3 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
9.2 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
61.9%
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.
CNA Affected
[
{
"product": "Tower",
"vendor": "[UNKNOWN]",
"versions": [
{
"status": "affected",
"version": "3.3.3"
}
]
}
]Related
7.3 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
9.2 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
61.9%