CVE-2020-1738CWE-88

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified

Low · published March 16, 2020

CVSS v3.1
3.9
EPSS
0%
Percentile
33.0
In the wild
Unconfirmed
What it is

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00399 · 33.0th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2020-03-16T15:08Z
EPSS history
Timeline
  • 16 MAR 15:08Z
    A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified
    cvelistv5