CVE-2020-14327CWE-918

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2

published May 27, 2021

CVSS
—
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2021-05-27T19:44Z
EPSS history
Timeline
  • 27 MAY 19:44Z
    A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2
    cvelistv5