CVE-2024-1657

HIGH

8.1

Beschreibung

A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.

CVE Details

CVSS v3.1 Bewertung8.1

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht4/25/2024

Zuletzt geandert2/25/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-319

Referenzen

https://access.redhat.com/errata/RHSA-2024:1057(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2024-1657(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2265085(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2024:1057(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/security/cve/CVE-2024-1657(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=2265085(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.