High severity · published Oct 4, 2023
CVE-2023-4237
A flaw was found in the Ansible Automation Platform
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Ansible Automation Platform · Redhat
2.0 · source: NVD
AC
Ansible Collection · Redhat
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4237
access.redhat.com
https://access.redhat.com/errata/RHBA-2023:5653
access.redhat.com
https://access.redhat.com/errata/RHBA-2023:5666
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4237
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2229979
security.netapp.com
https://security.netapp.com/advisory/ntap-20241025-0002/
More from Ansible Automation Platform
6.5
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape
7.8
CVE-2023-5764
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data
7.7
CVE-2026-44495
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
7.5
CVE-2026-46625
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection