CVE-2021-3701CWE-276

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations

published August 23, 2022

CVSS
—
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2022-08-23T15:50Z
EPSS history
Timeline
  • 23 AUG 15:50Z
    A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations
    cvelistv5