CVE-2020-14328

LOW

Ansible Tower < 3.7.2 - Server-Side Request Forgery via URL Processing

Title source: llm
STIX 2.1

Description

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.

References (1)

Core 1
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1856786

Scores

CVSS v3 3.3
EPSS 0.0003
EPSS Percentile 10.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-918
Status published
Products (1)
redhat/ansible_tower < 3.7.2
Published May 27, 2021
Tracked Since Feb 18, 2026