Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-20180
HistoryMar 16, 2022 - 12:00 a.m.

CVE-2021-20180

2022-03-1600:00:00
ubuntu.com
ubuntu.com
9
ansible module
bitbucket pipeline
credentials disclosure
security feature
confidentiality
unix

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

12.6%

A flaw was found in ansible module where credentials are disclosed in the
console log by default and not protected by the security feature when using
the bitbucket_pipeline_variable module. This flaw allows an attacker to
steal bitbucket_pipeline credentials. The highest threat from this
vulnerability is to confidentiality.

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

12.6%