CVE-2024-11483

Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

State: Published
Severity: 5.0 Medium
Published: Nov 25, 2024
Updated: Nov 20, 2025
Reserved: Nov 20, 2024

Description

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N	redhat

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
django-ansible-base	v2024.10.17 and earlierAffected
Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat	0:2.5.20241218-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat	0:2.5.20241218-1.el9ap and laterNot affected

References

RHSA-2024:11145vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-11483vdb-entry
RHBZ#2327579issue-tracking
https://github.com/ansible/django-ansible-base/commit/845b3e1838cc0762a7f9f3e0379c5274519d9a44

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.