Medium severity · published Oct 4, 2023
CVE-2023-4380
A logic flaw exists in Ansible Automation platform
6.3
CVSS
0.6%
EPSS
No
On KEV
Description
A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Ansible Automation Platform · Redhat
2.4 · source: NVD
AD
Ansible Developer · Redhat
1.1 · source: NVD
AI
Ansible Inside · Redhat
1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4380
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4380
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:4693
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4380
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2232324
More from Ansible Automation Platform
6.5
CVE-2026-48710
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
8.8
CVE-2021-4112
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape
7.8
CVE-2023-5764
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data
7.8
CVE-2023-4237
A flaw was found in the Ansible Automation Platform
7.7
CVE-2026-44495
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge