Описание
Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback).
Ссылки
- Third Party AdvisoryVDB Entry
- Issue TrackingVendor Advisory
- Third Party AdvisoryVDB Entry
- Issue TrackingVendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:redhat:ansible_tower:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*
EPSS
Процентиль: 35%
0.00144
Низкий
5.2 Medium
CVSS3
6.5 Medium
CVSS3
3.3 Low
CVSS2
Дефекты
CWE-113
CWE-93
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For header allows internal servers to deploy other systems (using callback).
EPSS
Процентиль: 35%
0.00144
Низкий
5.2 Medium
CVSS3
6.5 Medium
CVSS3
3.3 Low
CVSS2
Дефекты
CWE-113
CWE-93