← Retour aux CVEs

CVE-2017-7550

CRITICAL

9.8

Description

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie11/21/2017

Derniere modification4/20/2025

Sourcenvd

Observations honeypot0

Produits affectes

redhat:ansibleredhat:enterprise_linux_server

Faiblesses (CWE)

CWE-532CWE-532

References

https://access.redhat.com/errata/RHSA-2017:2966(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=1473645(secalert@redhat.com)

https://github.com/ansible/ansible/issues/30874(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2017:2966(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1473645(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/ansible/ansible/issues/30874(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.