High severity · published May 2, 2018
CVE-2018-1101
Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation
7.2
CVSS
1.9%
EPSS
No
On KEV
Description
Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Ansible Tower · Redhat
before 3.2.4 · source: NVD
CL
Cloudforms · Redhat
4.5; 4.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1101
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1101
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1328
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1972
Third Party Advisory
https://access.redhat.com/security/cve/cve-2018-1101
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1563492
Vendor Advisory
https://www.ansible.com/security
More from Ansible Tower
9.8
CVE-2018-16879
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ
9.8
CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing…
9.8
CVE-2015-9262
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow
9.8
CVE-2018-12910
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape