CVE-2021-3589
Description
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Détails du score du système commun d'évaluation des vulnérabilités (CVSS)
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
Les mesures et les scores CVSS suivants sont préliminaires et sujets à révision.
Répartition des scores CVSS v3
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Score de base | 8 | 8 | N/A |
| Vecteur d'attaque | Network | Network | N/A |
| Complexité de l'attaque | High | High | N/A |
| Privilèges requis | High | High | N/A |
| Interaction avec l'utilisateur | None | None | N/A |
| Champ d'application | Changed | Changed | N/A |
| Confidentialité | High | High | N/A |
| Impact sur l'intégrité | High | High | N/A |
| Impact sur la disponibilité | High | High | N/A |
Vecteur
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Comprendre la Défaillance (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Remerciements
This issue was discovered by Evgeni Golov (Red Hat). Upstream acknowledges Foreman project as the original reporter.
Questions fréquemment posées
Not sure what something means? Check out our Security Glossary.
Vous souhaitez recevoir des notifications d'errata ? Signez ici.
