Описание
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Ссылки
- Issue TrackingPatchVendor Advisory
- PatchThird Party Advisory
- Issue TrackingPatchVendor Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
Одно из
EPSS
7.2 High
CVSS3
7.2 High
CVSS3
4 Medium
CVSS2
Дефекты
Связанные уязвимости
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.
Уязвимость веб-интерфейса Ansible Tower средства управления конфигурациями Ansible, связанная с недостатками управления регистрационными данными, позволяющая нарушителю повысить свои привилегии
EPSS
7.2 High
CVSS3
7.2 High
CVSS3
4 Medium
CVSS2