CVE-2020-10782
published 2020-06-18CVE-2020-10782: An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and…
PriorityP425medium6.5CVSS 3.1
AVLACLPRLUINSCCHINAN
EPSS
0.29%
21.6th percentile
An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality. This is fixed in Ansible version 3.7.1.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | ansible_tower | — | — |
| red_hat | ansible_tower | — | — |
| redhat | ansible_tower | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8g82-ff8g-pqf2: An exposure of sensitive information flaw was found in Ansible Tower before version 3
ghsa_unreviewed·2022-05-24
CVE-2020-10782 [LOW] CWE-732 GHSA-8g82-ff8g-pqf2: An exposure of sensitive information flaw was found in Ansible Tower before version 3
An exposure of sensitive information flaw was found in Ansible Tower before version 3.7.1. sensitive information such as Splunk tokens could be readable in the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality.
Red Hat
Tower: rsyslog configuration has world readable permissions
vendor_redhat·2020-06-17·CVSS 6.5
CVE-2020-10782 [MEDIUM] CWE-276 Tower: rsyslog configuration has world readable permissions
Tower: rsyslog configuration has world readable permissions
An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality. This is fixed in Ansible version 3.7.1.
An exposure of sensitive information flaw was found in Ansible. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality.
Statement: * Ansible Tower 3.7.0 is affected.
Mitigation: Setting manual permi
No detection rules found.
No public exploits indexed.
2020-06-18
Published