CVE-2020-14327

State: Published
Severity: Not scored
Published: May 27, 2021
Updated: Aug 4, 2024
Reserved: Jun 17, 2020

Description

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.

Scores

The record has no CVSS score.

Weaknesses

CWE-918

Affected Products

Product	Versions
Towern/a	ansible_tower 3.6.5, ansible_tower 3.7.2Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1856785

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.