Login Request a demo
High severity · published Nov 26, 2019
CVE-2019-14890
A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain…
8.4
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Ansible Tower · Redhat
3.6.0 · source: NVD
Affected product
AT
Ansible Tower
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14890
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14890
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14890
More from Ansible Tower
9.8
CVE-2018-16879
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ
9.8
CVE-2018-17456
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing…
9.8
CVE-2015-9262
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow
9.8
CVE-2018-12910
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape