CVE-2020-14329
published 2021-05-27CVE-2020-14329: A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.27%
18.7th percentile
A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | ansible_tower | < 3.7.2 | 3.7.2 |
| redhat | ansible_tower | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c7r9-mwvj-rr98: A data exposure flaw was found in Ansible Tower in versions before 3
ghsa_unreviewed·2022-05-24
CVE-2020-14329 [LOW] CWE-200 GHSA-c7r9-mwvj-rr98: A data exposure flaw was found in Ansible Tower in versions before 3
A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.
Red Hat
Tower: Sensitive Data Exposure on Label
vendor_redhat·2020-07-14·CVSS 3.3
CVE-2020-14329 [LOW] CWE-200 Tower: Sensitive Data Exposure on Label
Tower: Sensitive Data Exposure on Label
A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.
A data exposure flaw was found in Tower, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.
Statement: Ansible Tower 3.7.1 as well as previous versions are affected.
No detection rules found.
No public exploits indexed.
2021-05-27
Published