CVE-2019-14890CWE-312

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new…

High · published November 26, 2019

CVSS v3.0
8.4
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.

The record
Technical detail
CVSS v3.0
8.4 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2019-11-26T06:46Z
EPSS history
Timeline
  • 26 NOV 06:46Z
    A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new…
    cvelistv5