CVE-2023-5115

MEDIUM

Ansible Automation Platform - Path Traversal via Malicious Role Symlink

Title source: llm

Description

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

References (5)

Core 5

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2023:5701

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2023:5758

Vendor Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2023-5115

Issue Tracking issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2233810

Scores

CVSS v3 6.3

EPSS 0.0086

EPSS Percentile 53.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Details

CWE

CWE-22 CWE-36

Status published

Products (9)

debian/debian_linux 10.0

pypi/ansible 0 - 8.5.0PyPI

redhat/ansible_automation_platform 1.2

redhat/ansible_automation_platform 2.3

redhat/ansible_automation_platform 2.4

redhat/ansible_developer 1.0

redhat/ansible_developer 1.1

redhat/ansible_inside 1.1

redhat/ansible_inside 1.2

Published Dec 18, 2023

Tracked Since Feb 18, 2026