PT-2024-37897 · Ansible · Ansible Automation Controller

Robb Gatica · Published 2024-02-09 · Updated 2024-09-12 · CVE-2024-6840

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ansible Automation Controller (affected versions not specified)

Description An improper authorization flaw exists in the Ansible Automation Controller, allowing an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-6840

RHSA-2024:6428

Affected Products

Ansible Automation Controller

References · 8

• https://access.redhat.com/errata/RHSA-2024:6428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6840 · Security Note
• https://t.me/cvedetector/5501 · Telegram Post
• https://twitter.com/RedPacketSec/status/1755895726863728721 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2298492 · Note
• https://twitter.com/VulmonFeeds/status/1834309516004925746 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2024-6840 · Note
• https://twitter.com/CVEnew/status/1834272028234293363 · Twitter Post