PT-2018-10157 · Red Hat · Ansible Tower

Published 2018-08-22 · Updated 2019-10-09 · CVE-2018-10884

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.1.8 and 3.2.6

Description The issue allows for cross-site request forgery (CSRF) in the awx/api/authentication.py module. An attacker could exploit this by tricking already authenticated users into visiting a malicious site, thereby hijacking the authtoken cookie.

Recommendations For versions prior to 3.1.8, update to version 3.1.8 or later. For versions prior to 3.2.6, update to version 3.2.6 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-10884

Affected Products

Ansible Tower

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-10884 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10884 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10884 · Vendor Advisory
• http://securityfocus.com/bid/105136 · Note