CVE-2020-1734CWE-78
A flaw was found in the pipe lookup plugin of ansible
High · published March 3, 2020
What it is
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
The record
Technical detail
- CVSS v3.1
- 7.4 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00458 · 38.8th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2020-03-03T21:23Z
EPSS history
Timeline