CVE-2017-7466CWE-20

Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems

High · published June 22, 2018

CVSS v3.0
8.0
EPSS
3%
Percentile
87.7
In the wild
Unconfirmed
What it is

Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03142 · 87.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-06-22T13:00Z
EPSS history
Timeline
  • 22 JUN 13:00Z
    Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems
    cvelistv5