CVE-2020-1738

State: Published
Severity: 3.9 Low
Published: Mar 16, 2020
Updated: Aug 4, 2024
Reserved: Nov 27, 2019

Description

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Scores

CVSS	Score	Vector	Source
3.1	3.9 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L	redhat

Weaknesses

CWE-88

Affected Products

Product	Versions
ansibleRed Hat	2.7.x, 2.8.x, 2.9.xAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738
https://github.com/ansible/ansible/issues/67796
GLSA-202006-11vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.