Vulnerabilities > CVE-2020-14327 - Server-Side Request Forgery (SSRF) vulnerability in Redhat Ansible Tower

047910
CVSS 2.1 - LOW
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
local
low complexity
redhat
CWE-918
NVD
Published: 2021-05-27
Updated: 2021-06-07

Summary

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.

Vulnerable Configurations

Part Description Count
Application
Redhat
118

Common Weakness Enumeration (CWE)

References