← Zuruck zu CVEs
CVE-2020-14330
MEDIUM5.0
Beschreibung
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
CVE Details
CVSS v3.1 Bewertung5.0
SchweregradMEDIUM
CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
AngriffsvektorLOCAL
KomplexitatLOW
Erforderliche PrivilegienLOW
BenutzerinteraktionREQUIRED
Veroffentlicht9/11/2020
Zuletzt geandert11/21/2024
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
debian:debian_linuxredhat:ansible_engine
Schwachen (CWE)
CWE-532CWE-532
Referenzen
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330(secalert@redhat.com)
https://github.com/ansible/ansible/issues/68400(secalert@redhat.com)
https://www.debian.org/security/2021/dsa-4950(secalert@redhat.com)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/ansible/ansible/issues/68400(af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2021/dsa-4950(af854a3a-2127-422b-91ae-364da2661108)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.