CVE-2021-4112
published 2022-08-25CVE-2021-4112: A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege…
PriorityP343high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.23%
14.0th percentile
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | ansible_automation_platform | — | — |
| redhat | ansible_automation_platform | — | — |
| redhat | ansible_automation_platform_early_access | — | — |
| redhat | ansible_tower | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2q78-vv73-5vr2: A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape
ghsa_unreviewed·2022-08-26
CVE-2021-4112 [HIGH] CWE-552 GHSA-2q78-vv73-5vr2: A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
Red Hat
ansible-tower: Privilege escalation via job isolation escape
vendor_redhat·2021-12-01·CVSS 8.8
CVE-2021-4112 [HIGH] CWE-552 ansible-tower: Privilege escalation via job isolation escape
ansible-tower: Privilege escalation via job isolation escape
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
Mitigation: Red Hat has investigated whether possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-25
Published