Security restrictions bypass in Ansible Tower - CVE-2018-16879
Published: December 20, 2018 / Updated: December 26, 2018
Vulnerability identifier: #VU16715
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16879
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to bypass security restrictions.
The vulnerability exists due to security channel is not set properly for AMPQ connection. An adjacent attacker can bypass security restrictions and gain access to potentially sensitive information or cause the service to crash.
Affected software
Ansible Tower
How to mitigate CVE-2018-16879
Update to version 3.3.3.
Ansible Tower - update to 3.3.3