CVE-2019-3828CWE-22

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the…

Medium · published March 27, 2019

CVSS v3.0
4.2
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

The record
Technical detail
CVSS v3.0
4.2 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00526 · 43.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2019-03-27T00:00Z
EPSS history
Timeline
  • 27 MAR 00:00Z
    Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the…
    cvelistv5