CVE-2023-3971

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Score

CVSS 3.1 7.3 High

Status

Modified - secalert@redhat.com

Published

2023-10-04

Last modified

2025-11-20

Weaknesses

CWE-79, CWE-80

Affected products

• Ansible Automation Controller (Redhat)
• Ansible Automation Platform (Redhat)
• Ansible Automation Platform Developer (Redhat)
• Ansible Automation Platform Inside (Redhat)
• Ansible Developer (Redhat)
• Ansible Inside (Redhat)

References

• https://access.redhat.com/errata/RHSA-2023:4340
• https://access.redhat.com/errata/RHSA-2023:4590
• https://access.redhat.com/security/cve/CVE-2023-3971
• https://bugzilla.redhat.com/show_bug.cgi?id=2226965