Riskcovery

CVE-2024-1657

Platform: insecure websocket used when interacting with eda server

State
Published
Severity
8.1 High
Published
Apr 25, 2024
Updated
Feb 25, 2026
Reserved
Feb 20, 2024

Read the record on cve.org

Description

A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nredhat

Weaknesses

  • CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

ProductVersions
ansible
  • before 2.4Affected
Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat
  • 0:2.4-6.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat
  • 0:1.0.5-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.4 for RHEL 8Red Hat
  • 0:1.0.5-1.el8ap and laterNot affected
Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat
  • 0:2.4-6.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat
  • 0:1.0.5-1.el9ap and laterNot affected
Red Hat Ansible Automation Platform 2.4 for RHEL 9Red Hat
  • 0:1.0.5-1.el9ap and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.