Description
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.
References (2)
Core 2
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2028121
Vendor Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-4112
Scores
CVSS v3
8.8
EPSS
0.0012
EPSS Percentile
30.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Details
CWE
CWE-552
Status
published
Products (5)
redhat/ansible_automation_platform
2.0
redhat/ansible_automation_platform
2.1
redhat/ansible_automation_platform_early_access
2.0
redhat/ansible_automation_platform_text-only_advisories
redhat/ansible_tower
3.0
Published
Aug 25, 2022
Tracked Since
Feb 18, 2026