QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2019-10156

Back to search

CVE-2019-10156

Published: Jul 30, 2019

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.0

4.6

MEDIUM

Description

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

VendorProductVersions

Red Hat

ansible

affected
fixed in 2.6.18
affected
fixed in 2.7.12
affected
fixed in 2.8.2

Weaknesses (CWE)

CWE-200

CVSS v3.0 Details

CVSS v3.0 Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

References

RHSA-2019:3744
vendor-advisory
x_refsource_REDHAT
RHSA-2019:3789
vendor-advisory
x_refsource_REDHAT
DSA-4950
vendor-advisory
x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now