Vulnerability · Published Mar 9, 2021 · Assigned by redhat
CVE-2021-20253
Medium 6.7
In plain English
A medium-severity security flaw in ansible-tower. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)6.7Medium
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ansible-tower | ansible-tower 3.8.2, ansible-tower 3.7.5, ansible-tower 3.6.7 |
Weakness: CWE-552
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1928847 x_refsource_MISC