Login Request a demo
High severity · published May 2, 2018
CVE-2018-1104
Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server
8.8
CVSS
2.5%
EPSS
No
On KEV
Description
Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Ansible Tower · Redhat
through 3.2.3 · source: NVD
CL
Cloudforms · Redhat
4.5; 4.6 · source: NVD
Affected product
AT
Ansible Tower
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1104
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1328
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1972
Vendor Advisory
https://access.redhat.com/security/cve/cve-2018-1104
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1565862
Vendor Advisory
https://www.ansible.com/security
More from Ansible Tower
9.8
CVE-2018-16879
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ
9.8
CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing…
9.8
CVE-2015-9262
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow
9.8
CVE-2018-12910
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape