Vulnerability-Lookup

CVE-2018-1104 (GCVE-0-2018-1104)

Vulnerability from cvelistv5 – Published: 2018-05-02 19:00 – Updated: 2024-09-16 19:09

Summary

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

Severity

8.8 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20

Assigner

redhat redhat root

References

5 references

URL	Tags
https://www.ansible.com/security	x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1565862	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:1972	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1328	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/cve-2018-1104	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Red Hat, Inc.	Ansible Tower	Affected: through version 3.2.3	guessed

Date Public

2018-04-27 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:51:48.555Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ansible.com/security"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
          },
          {
            "name": "RHSA-2018:1972",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1972"
          },
          {
            "name": "RHSA-2018:1328",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1328"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2018-1104"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Ansible Tower",
          "vendor": "Red Hat, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "through version 3.2.3"
            }
          ]
        }
      ],
      "datePublic": "2018-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-26T09:57:02.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ansible.com/security"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
        },
        {
          "name": "RHSA-2018:1972",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1972"
        },
        {
          "name": "RHSA-2018:1328",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1328"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2018-1104"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "DATE_PUBLIC": "2018-04-27T00:00:00",
          "ID": "CVE-2018-1104",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Ansible Tower",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "through version 3.2.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Red Hat, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ansible.com/security",
              "refsource": "CONFIRM",
              "url": "https://www.ansible.com/security"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
            },
            {
              "name": "RHSA-2018:1972",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1972"
            },
            {
              "name": "RHSA-2018:1328",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1328"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2018-1104",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2018-1104"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2018-1104",
    "datePublished": "2018-05-02T19:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-09-16T19:09:02.633Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-1104",
      "date": "2026-09-14",
      "epss": "0.02517",
      "percentile": "0.83934"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"3.2.3\", \"matchCriteriaId\": \"C796B714-EA6E-4DFC-9467-9DC40110E053\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32E1BA91-4695-4E64-A9D7-4A6CB6904D41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"67F7263F-113D-4BAE-B8CB-86A61531A2AC\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.\"}, {\"lang\": \"es\", \"value\": \"Ansible Tower hasta la versi\\u00f3n 3.2.3 tiene una vulnerabilidad que permite que usuarios que solo tienen acceso para definir variables para una plantilla de trabajo ejecuten c\\u00f3digo arbitrario en el servidor Tower.\"}]",
      "id": "CVE-2018-1104",
      "lastModified": "2024-11-21T03:59:11.410",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2018-05-02T19:29:00.607",
      "references": "[{\"url\": \"https://access.redhat.com/errata/RHSA-2018:1328\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:1972\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/security/cve/cve-2018-1104\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1565862\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://www.ansible.com/security\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:1328\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2018:1972\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://access.redhat.com/security/cve/cve-2018-1104\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=1565862\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://www.ansible.com/security\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-1104\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2018-05-02T19:29:00.607\",\"lastModified\":\"2024-11-21T03:59:11.410\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.\"},{\"lang\":\"es\",\"value\":\"Ansible Tower hasta la versi\u00f3n 3.2.3 tiene una vulnerabilidad que permite que usuarios que solo tienen acceso para definir variables para una plantilla de trabajo ejecuten c\u00f3digo arbitrario en el servidor Tower.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.2.3\",\"matchCriteriaId\":\"C796B714-EA6E-4DFC-9467-9DC40110E053\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32E1BA91-4695-4E64-A9D7-4A6CB6904D41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67F7263F-113D-4BAE-B8CB-86A61531A2AC\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1328\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1972\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/cve-2018-1104\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1565862\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://www.ansible.com/security\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1328\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2018:1972\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/cve-2018-1104\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1565862\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://www.ansible.com/security\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-27T03:04:21+00:00",
      "cve": "CVE-2018-1104",
      "id": "CVE-2018-1104",
      "initial_release_date": "2018-04-27T00:00:00+00:00",
      "product_status:fixed": "69",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ansible-tower: Remote code execution by users with access to define variables in job templates",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-1104.json",
      "version": "3"
    }
  }
}

CNVD-2018-14411

Vulnerability from cnvd - Published: 2018-08-01

Title

Ansible Tower存在未明漏洞

Description

Ansible是美国Ansible公司的一款计算机系统配置管理器，它可用于发布、管理和编排计算机系统。Ansible Tower（又名Ansible UI）是其中的一个提供了用户界面（UI）、仪表板和REST API的任务控制应用程序。 Ansible Tower 3.2.3及之前版本中存在安全漏洞。攻击者可利用该漏洞在Tower服务器上执行任意代码。

Severity

中

Patch Name

Ansible Tower存在未明漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.ansible.com/security

Reference

https://access.redhat.com/security/cve/cve-2018-1104

Impacted products

Name
Ansible Ansible Tower <=3.2.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-1104",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1104"
    }
  },
  "description": "Ansible\u662f\u7f8e\u56fdAnsible\u516c\u53f8\u7684\u4e00\u6b3e\u8ba1\u7b97\u673a\u7cfb\u7edf\u914d\u7f6e\u7ba1\u7406\u5668\uff0c\u5b83\u53ef\u7528\u4e8e\u53d1\u5e03\u3001\u7ba1\u7406\u548c\u7f16\u6392\u8ba1\u7b97\u673a\u7cfb\u7edf\u3002Ansible Tower\uff08\u53c8\u540dAnsible UI\uff09\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u63d0\u4f9b\u4e86\u7528\u6237\u754c\u9762\uff08UI\uff09\u3001\u4eea\u8868\u677f\u548cREST API\u7684\u4efb\u52a1\u63a7\u5236\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nAnsible Tower 3.2.3\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Tower\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Sam Fowler",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.ansible.com/security",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-14411",
  "openTime": "2018-08-01",
  "patchDescription": "Ansible\u662f\u7f8e\u56fdAnsible\u516c\u53f8\u7684\u4e00\u6b3e\u8ba1\u7b97\u673a\u7cfb\u7edf\u914d\u7f6e\u7ba1\u7406\u5668\uff0c\u5b83\u53ef\u7528\u4e8e\u53d1\u5e03\u3001\u7ba1\u7406\u548c\u7f16\u6392\u8ba1\u7b97\u673a\u7cfb\u7edf\u3002Ansible Tower\uff08\u53c8\u540dAnsible UI\uff09\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u63d0\u4f9b\u4e86\u7528\u6237\u754c\u9762\uff08UI\uff09\u3001\u4eea\u8868\u677f\u548cREST API\u7684\u4efb\u52a1\u63a7\u5236\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nAnsible Tower 3.2.3\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728Tower\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Ansible Tower\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Ansible Ansible Tower \u003c=3.2.3"
  },
  "referenceLink": "https://access.redhat.com/security/cve/cve-2018-1104",
  "serverity": "\u4e2d",
  "submitTime": "2018-05-21",
  "title": "Ansible Tower\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

FKIE_CVE-2018-1104

Vulnerability from fkie_nvd - Published: 2018-05-02 19:29 - Updated: 2026-06-17 01:50

Severity

8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

References

URL	Tags
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:1328	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/errata/RHSA-2018:1972	Vendor Advisory
secalert@redhat.com	https://access.redhat.com/security/cve/cve-2018-1104	Vendor Advisory
secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=1565862	Issue Tracking, Vendor Advisory
secalert@redhat.com	https://www.ansible.com/security	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:1328	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHSA-2018:1972	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/security/cve/cve-2018-1104	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=1565862	Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.ansible.com/security	Vendor Advisory

Impacted products

Vendor	Product	Version
redhat	ansible_tower	*
redhat	cloudforms	4.5
redhat	cloudforms	4.6

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Ansible Tower",
          "vendor": "Red Hat, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "through version 3.2.3"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C796B714-EA6E-4DFC-9467-9DC40110E053",
              "versionEndIncluding": "3.2.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "32E1BA91-4695-4E64-A9D7-4A6CB6904D41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "67F7263F-113D-4BAE-B8CB-86A61531A2AC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server."
    },
    {
      "lang": "es",
      "value": "Ansible Tower hasta la versi\u00f3n 3.2.3 tiene una vulnerabilidad que permite que usuarios que solo tienen acceso para definir variables para una plantilla de trabajo ejecuten c\u00f3digo arbitrario en el servidor Tower."
    }
  ],
  "id": "CVE-2018-1104",
  "lastModified": "2026-06-17T01:50:29.347",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-05-02T19:29:00.607",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:1328"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:1972"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/cve-2018-1104"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ansible.com/security"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:1328"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2018:1972"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/cve-2018-1104"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ansible.com/security"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-4839-8MXX-4XR9

Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33

Details

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

Severity

8.8 (High)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-1104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-02T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.",
  "id": "GHSA-4839-8mxx-4xr9",
  "modified": "2022-05-13T01:33:32Z",
  "published": "2022-05-13T01:33:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1104"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1328"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:1972"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/cve-2018-1104"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
    },
    {
      "type": "WEB",
      "url": "https://www.ansible.com/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2018-1104

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

Aliases

CVE-2018-1104

Aliases

CVE-2018-1104

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-1104",
    "description": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.",
    "id": "GSD-2018-1104",
    "references": [
      "https://access.redhat.com/errata/RHSA-2018:1972",
      "https://access.redhat.com/errata/RHSA-2018:1328"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-1104"
      ],
      "details": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.",
      "id": "GSD-2018-1104",
      "modified": "2023-12-13T01:22:36.814050Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "DATE_PUBLIC": "2018-04-27T00:00:00",
        "ID": "CVE-2018-1104",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Ansible Tower",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "through version 3.2.3"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Red Hat, Inc."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-20"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.ansible.com/security",
            "refsource": "CONFIRM",
            "url": "https://www.ansible.com/security"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
          },
          {
            "name": "RHSA-2018:1972",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:1972"
          },
          {
            "name": "RHSA-2018:1328",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2018:1328"
          },
          {
            "name": "https://access.redhat.com/security/cve/cve-2018-1104",
            "refsource": "MISC",
            "url": "https://access.redhat.com/security/cve/cve-2018-1104"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.2.3",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2018-1104"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-94"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.ansible.com/security",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://www.ansible.com/security"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Vendor Advisory"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1565862"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2018-1104",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/security/cve/cve-2018-1104"
            },
            {
              "name": "RHSA-2018:1328",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:1328"
            },
            {
              "name": "RHSA-2018:1972",
              "refsource": "REDHAT",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2018:1972"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2019-10-09T23:38Z",
      "publishedDate": "2018-05-02T19:29Z"
    }
  }
}

RHSA-2018:1328

Vulnerability from csaf_redhat - Published: 2018-05-07 20:42 - Updated: 2026-06-28 08:53

Summary

Red Hat Security Advisory: CloudForms 4.6.2 bug fix and enhancement update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2018-1104.

CVE-2018-1104

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

8.8 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 50 products

https://access.redhat.com/errata/RHSA-2018:1328

Open the full advisory

RHSA-2018:1972

Vulnerability from csaf_redhat - Published: 2018-06-25 14:17 - Updated: 2026-06-28 08:56

Summary

Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2018-1104.

CVE-2018-1104

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

8.8 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 19 products

https://access.redhat.com/errata/RHSA-2018:1972

Open the full advisory

RHSA-2018_1328

Vulnerability from csaf_redhat - Published: 2018-05-07 20:42 - Updated: 2024-11-22 11:48

Summary

Red Hat Security Advisory: CloudForms 4.6.2 bug fix and enhancement update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2018-1104.

CVE-2018-1104

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

8.8 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 50 products

https://access.redhat.com/errata/RHSA-2018:1328

Open the full advisory

RHSA-2018_1972

Vulnerability from csaf_redhat - Published: 2018-06-25 14:17 - Updated: 2024-11-22 11:48

Summary

Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2018-1104.

CVE-2018-1104

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

8.8 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 19 products

https://access.redhat.com/errata/RHSA-2018:1972

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2018-1104 (GCVE-0-2018-1104)

Tags

Sightings

Nomenclature