CVE-2019-19340

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.

Score

CVSS 3.1 8.2 High

Status

Modified - secalert@redhat.com

Published

2019-12-19

Last modified

2024-08-05

Weaknesses

CWE-1188

Affected products

• Tower (Red Hat)
• Ansible Tower (Redhat)
• Enterprise Linux (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19340