CVE-2018-1104

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

Score

CVSS 3.0 8.8 High

Status

Modified - secalert@redhat.com

Published

2018-05-02

Last modified

2024-09-16

Weaknesses

CWE-20, CWE-94

Affected products

• Ansible Tower (Red Hat Inc.)
• Ansible Tower (Redhat)
• Cloudforms (Redhat)

References

• https://access.redhat.com/errata/RHSA-2018:1328
• https://access.redhat.com/errata/RHSA-2018:1972
• https://access.redhat.com/security/cve/cve-2018-1104
• https://bugzilla.redhat.com/show_bug.cgi?id=1565862
• https://www.ansible.com/security