Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-588W-W6MV-3CW5
HistoryMay 13, 2022 - 1:06 a.m.

Ansible Insertion of Sensitive Information into Log File vulnerability

2022-05-1301:06:04
CWE-532
GitHub Advisory Database
github.com
11
ansible
jenkins
vulnerability
fixed
remote attackers
sensitive information
module documentation

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

81.2%

JSON

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host’s logs. This flaw was fixed by not allowing passwords to be specified in the “params” argument, and noting this in the module documentation.

Affected configurations

Vulners
Node
ansibleansibleRange2.3.0.0–2.3.3.0
OR
ansibleansibleRange2.4.0.0–2.4.1.0
VendorProductVersionCPE
ansibleansible*cpe:2.3:a:ansible:ansible:*:*:*:*:*:*:*:*

Related

nvd 1
prion 1
nessus 6
openvas 3
osv 4
veracode 2
mageia 1
redhatcve 1
debiancve 1
fedora 3
cvelist 1
ubuntucve 1
redhat 1
suse 1
cve 1
nvd
nvd
CVE-2017-7550
2017-11-21 17:29:00
prion
prion
Information disclosure
2017-11-21 17:29:00
nessus
nessus
Fedora 25 : ansible (2017-008017c9fe)
2017-11-09 00:00:00
Fedora 27 : ansible (2017-c2729c23b0)
2018-01-15 00:00:00
Fedora 26 : ansible (2017-8bf1b0c692)
2017-11-09 00:00:00
openvas
openvas
Fedora Update for ansible FEDORA-2017-8bf1b0c692
2017-11-09 00:00:00
Fedora Update for ansible FEDORA-2017-008017c9fe
2017-11-09 00:00:00
Mageia: Security Advisory (MGASA-2017-0399)
2022-01-28 00:00:00
osv
osv
PYSEC-2017-4
2017-11-21 17:29:00
Ansible Insertion of Sensitive Information into Log File vulnerability
2022-05-13 01:06:04
CVE-2017-7550
2017-11-21 17:29:00
veracode
veracode
Information Disclosure
2019-01-15 09:19:11
Information Disclosure
2017-09-26 07:14:32
mageia
mageia
Updated ansible package fixes security vulnerability
2017-11-03 00:47:07
redhatcve
redhatcve
CVE-2017-7550
2017-09-25 14:48:58
debiancve
debiancve
CVE-2017-7550
2017-11-21 17:29:00
fedora
fedora
[SECURITY] Fedora 26 Update: ansible-2.4.1.0-2.fc26
2017-11-08 23:28:55
[SECURITY] Fedora 25 Update: ansible-2.4.1.0-2.fc25
2017-11-08 23:31:13
[SECURITY] Fedora 27 Update: ansible-2.4.1.0-2.fc27
2017-11-11 13:53:03
cvelist
cvelist
CVE-2017-7550
2017-11-21 17:00:00
ubuntucve
ubuntucve
CVE-2017-7550
2017-11-21 00:00:00
redhat
redhat
(RHSA-2017:2966) Moderate: ansible security, bug fix, and enhancement update
2017-10-19 14:32:10
suse
suse
Security update for ansible (important)
2018-03-05 15:12:20
cve
cve
CVE-2017-7550
2017-11-21 17:29:00

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.008

Percentile

81.2%

JSON
Related for GHSA-588W-W6MV-3CW5
nvd1prion1nessus6openvas3osv4veracode2mageia1redhatcve1debiancve1fedora3cvelist1ubuntucve1redhat1suse1cve1