← Back to CVEs

CVE-2017-7550

CRITICAL

9.8

Description

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published11/21/2017

Last Modified4/20/2025

Sourcenvd

Honeypot Sightings0

Affected Products

redhat:ansibleredhat:enterprise_linux_server

Weaknesses (CWE)

CWE-532CWE-532

References

https://access.redhat.com/errata/RHSA-2017:2966(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=1473645(secalert@redhat.com)

https://github.com/ansible/ansible/issues/30874(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2017:2966(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1473645(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/ansible/ansible/issues/30874(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.