Template Injection

2023-12-0602:18:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

ansible

template injection

vulnerability

code injection

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

Percentile

5.1%

JSON

Ansible is vulnerable to Template Injection. The vulnerability is caused due to a user’s controller internal templating operations may remove the unsafe designation from template data. This could allow an attacker to use a specially crafted file to introduce code injection when supplying templating data.