Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:18355
HistoryMay 02, 2019 - 6:37 a.m.

Arbitrary Code Execution

2019-05-0206:37:16
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

Ansible Tower’s interface is vulnerable to arbitrary code execution. If a Tower project (SCM repo) definition does not have the ‘delete before update’ flag set, an attacker with commit access to the upstream playbook source repo could create a trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks.

References

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

Related for VERACODE:18355