CVE-2018-10884

CVE-2018-10884 affects Ansible Tower before 3.1.8 and before 3.2.6, where a CSRF flaw in awx/api/authentication.py allows an attacker to trick authenticated users into visiting a malicious page and hijack the authtoken cookie. Evidence from multiple sources confirms the vulnerable versions and th...

CVE-2017-7528: Improper Neutralization of CRLF Sequences in HTTP Headers

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems using callback...

CVE-2018-10884: Cross-Site Request Forgery (CSRF)

Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery CSRF in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie...

PT-2018-10157

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.1.8 and 3.2.6 Description The issue allows for cross-site request forgery CSRF in the awx/api/authentication.py module. An attacker could exploit this by tricking already authenticated users into visiting a...

CVE-2018-10884

Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable to cross-site request forgery CSRF in awx/api/authentication.py. An attacker could exploit this by tricking already authenticated users into visiting a malicious site and hijacking the authtoken cookie...

Design/Logic Flaw

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

CVE-2017-12148

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

CVE-2017-12148

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

CVE-2017-12148

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

CVE-2017-12148

CVE-2017-12148 affects Ansible Tower's UI (SCM repos). If a Tower project definition lacks the 'delete before update' flag, a committer to the upstream playbook can insert a Trojan playbook that, when run by Tower, adds git hooks to the checked-out repository and may execute arbitrary commands as...

CVE-2017-12148: Improper Input Validation

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

PT-2018-5372

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.1.5 Ansible Tower versions prior to 3.2.0 Description A flaw was found in Ansible Tower's interface with SCM repositories. If a Tower project definition does not have the 'delete before update' flag set, an...

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...

ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges

Ansible Tower, before version 3.2.4, has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update is now available for CloudForms Management Engine 5.8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Unspecified Vulnerability in Ansible Tower

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and orchestrate computer systems.Ansible Tower a.k.a. Ansible UI is one of the task control applications that provides a user interface UI, dashboard, and REST API. A security vulnerability...

ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges

Ansible Tower, before version 3.2.4, has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization...

ansible-tower: Remote code execution by users with access to define variables in job templates

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...

CVE-2018-1104

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...

Design/Logic Flaw

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server...