Vulnerability · Published May 27, 2021 · Assigned by redhat
CVE-2020-14328
Low 3.3
In plain English
A low-severity server-side request forgery in Tower. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.
Affected products (as reported)
Weakness: CWE-918
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1856786 x_refsource_MISC