CVE-2020-10782CWE-200CWE-276

An exposure of sensitive information flaw was found in Ansible version 3.7.0

Medium · published June 18, 2020

CVSS v3.1
6.5
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality. This is fixed in Ansible version 3.7.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-276 · Incorrect Default Permissions
Published
2020-06-18T12:49Z
EPSS history
Timeline
  • 18 JUN 12:49Z
    An exposure of sensitive information flaw was found in Ansible version 3.7.0
    cvelistv5