Vulnerability · Published Jul 31, 2020 · Assigned by redhat
CVE-2020-14337
Medium 5.8
In plain English
A medium-severity security flaw in Ansible Tower. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS NVD)5.8Medium
Exploit odds (30 days)1.5%top 25.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data confidentiality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Ansible Tower | Ansible Tower 3.7.1 as well as previous versions are affected. |
Weakness: CWE-209
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1859139 x_refsource_MISC