2 lines
3.8 KiB
JSON
2 lines
3.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"Ansible Tower","vendor":"Red Hat, Inc.","versions":[{"status":"affected","version":"through version 3.2.3"}]}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*","matchCriteriaId":"C796B714-EA6E-4DFC-9467-9DC40110E053","versionEndIncluding":"3.2.3","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*","matchCriteriaId":"32E1BA91-4695-4E64-A9D7-4A6CB6904D41","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*","matchCriteriaId":"67F7263F-113D-4BAE-B8CB-86A61531A2AC","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server."},{"lang":"es","value":"Ansible Tower hasta la versión 3.2.3 tiene una vulnerabilidad que permite que usuarios que solo tienen acceso para definir variables para una plantilla de trabajo ejecuten código arbitrario en el servidor Tower."}],"id":"CVE-2018-1104","lastModified":"2026-06-17T01:50:29.347","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-05-02T19:29:00.607","references":[{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2018:1328"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2018:1972"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/cve-2018-1104"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565862"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://www.ansible.com/security"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2018:1328"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/errata/RHSA-2018:1972"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/cve-2018-1104"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565862"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ansible.com/security"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-94"}],"source":"nvd@nist.gov","type":"Primary"}]}
|