CVE-2020-14332

MEDIUM

Ansible Engine 2.8.0-2.8.13 - Sensitive Information Exposure in Module Args via Check Mode

Title source: llm
STIX 2.1

Description

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/ansible/ansible/pull/71033
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4950

Scores

CVSS v3 5.5
EPSS 0.0041
EPSS Percentile 32.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-532 CWE-117
Status published
Products (3)
debian/debian_linux 10.0
pypi/ansible 0 - 2.8.14PyPI
redhat/ansible_engine 2.8.0 - 2.8.14
Published Sep 11, 2020
Tracked Since Feb 18, 2026