CVE-2016-9587CWE-20

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems

Medium · published April 24, 2018

CVSS v3.0
6.6
EPSS
17%
Percentile
97.1
In the wild
Unconfirmed
What it is

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

The record
Technical detail
CVSS v3.0
6.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17140 · 97.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-04-24T16:00Z
EPSS history
Timeline
  • 24 APR 16:00Z
    Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
    cvelistv5