Medium severity · published Oct 8, 2024
CVE-2024-9620
Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Ansible Automation Platform 2 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat Ansible Automation Platform 2
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9620
access.redhat.com
https://access.redhat.com/security/cve/CVE-2024-9620
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2317129
More from Red Hat Ansible Automation Platform 2
10.0
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.8
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
9.8
CVE-2026-39892
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
9.8
CVE-2026-27459
pyOpenSSL DTLS cookie callback buffer overflow