Description
A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system.
Scores
CVSS v3
8.1
EPSS
0.0006
EPSS Percentile
17.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-319
Status
published
Products (4)
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 8
0:1.0.5-1.el8ap
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 8
0:2.4-6.el8ap
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 9
0:1.0.5-1.el9ap
Red Hat/Red Hat Ansible Automation Platform 2.4 for RHEL 9
0:2.4-6.el9ap
Published
Apr 25, 2024
Tracked Since
Feb 18, 2026