CVE-2018-1101
ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.
Ansible Tower en versiones anteriores a la 3.2.4 tiene un error en la gestión de administradores de sistema y organización que permite el escalado de privilegios. Los administradores de organización pueden restablecer la contraseña de los administradores de sistema que son miembros de organizaciones, lo que permite que los administradores de organización accedan a todo el sistema.
Ansible Tower, before version 3.2.4, has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-12-04 CVE Reserved
- 2018-05-02 CVE Published
- 2023-09-23 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-266: Incorrect Privilege Assignment
- CWE-521: Weak Password Requirements
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://access.redhat.com/security/cve/cve-2018-1101 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2018:1328 | 2019-10-09 | |
https://access.redhat.com/errata/RHSA-2018:1972 | 2019-10-09 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1563492 | 2018-06-25 | |
https://www.ansible.com/security | 2019-10-09 | |
https://access.redhat.com/security/cve/CVE-2018-1101 | 2018-06-25 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Ansible Tower Search vendor "Redhat" for product "Ansible Tower" | < 3.2.4 Search vendor "Redhat" for product "Ansible Tower" and version " < 3.2.4" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Cloudforms Search vendor "Redhat" for product "Cloudforms" | 4.5 Search vendor "Redhat" for product "Cloudforms" and version "4.5" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Cloudforms Search vendor "Redhat" for product "Cloudforms" | 4.6 Search vendor "Redhat" for product "Cloudforms" and version "4.6" | - |
Affected
|