CVE-2024-11079CWE-20

Ansible-core: unsafe tagging bypass via hostvars object in ansible-core

Medium · published November 11, 2024

CVSS v3.1
5.5
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00529 · 43.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-11-11T23:32Z
EPSS history
Timeline
  • 11 NOV 23:32Z
    Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
    cvelistv5