CVE-2024-1657CWE-319

Platform: insecure websocket used when interacting with eda server

High · published April 25, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2024-04-25T16:28Z
EPSS history
Timeline
  • 25 APR 16:28Z
    Platform: insecure websocket used when interacting with eda server
    cvelistv5