PT-2021-13859 · Unknown · Ansible Tower

Matei Mal Badanoiu + 1 · Published 2021-03-09 · Updated 2023-11-26 · CVE-2021-20253

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ansible-tower (affected versions not specified)

Description: A flaw was found in the default installation of ansible-tower, allowing an attacker to elevate privileges from a low-privileged user to the awx user from outside the isolated environment through Job Isolation escape. The highest threat from this issue is to data confidentiality and integrity, as well as system availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2021-20253

Affected Products

Ansible Tower

References · 8

• https://osv.dev/vulnerability/CVE-2021-20253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20253 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1928847 · Vendor Advisory
• https://t.me/cvenotify/11044 · Telegram Post
• https://t.me/cvenotify/15424 · Telegram Post
• https://t.me/cibsecurity/24625 · Telegram Post
• https://t.me/cvenotify/11338 · Telegram Post
• https://t.me/cybersecuritytechnologies/9465 · Telegram Post