#VU86958 Missing Authorization in Ansible Automation Platform - CVE-2024-1657

Vulnerability identifier: #VU86958

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-1657

CWE-ID: CWE-862

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Ansible Automation Platform
Server applications / Other server solutions

Vendor: Red Hat Inc.

Description

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to usage of an insecure websocket during installation. A remote attacker with access to any of the machines in the CIDR block can pull all rulebook data from that websocket.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Ansible Automation Platform: 2.4

---

External links
https://bugzilla.redhat.com/show_bug.cgi?id=2265085

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.