CVE-2024-9620
Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 8, 2024
- Updated
- Nov 20, 2025
- Reserved
- Oct 8, 2024
Description
A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-319 Cleartext Transmission of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
event-driven-automation |
|
Red Hat Ansible Automation Platform 2Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2024-9620vdb-entry
- RHBZ#2317129issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.