CVE-2020-14329

CWE-200 — Information Exposure5 documents5 sources
Severity
3.3LOW
EPSS
0.0%
top 87.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Ansible Tower
Timeline
PublishedMay 27
Latest updateMay 24

Description

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5toweransible_tower 3.7.2

🔴Vulnerability Details

2
GHSA
GHSA-c7r9-mwvj-rr98: A data exposure flaw was found in Ansible Tower in versions before 3↗2022-05-24
▶
CVEList
CVE-2020-14329: A data exposure flaw was found in Ansible Tower in versions before 3↗2021-05-27
▶

📋Vendor Advisories

1
Red Hat
Tower: Sensitive Data Exposure on Label↗2020-07-14
▶

💬Community

1
Bugzilla
CVE-2020-14329 Tower: Sensitive Data Exposure on Label↗2020-07-14
▶