CVE-2019-19342CWE-209

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character

Medium · published December 19, 2019

CVSS v3.0
5.3
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01108 · 65.6th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2019-12-19T20:20Z
EPSS history
Timeline
  • 19 DEC 20:20Z
    A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character
    cvelistv5