CVE-2020-1738

EUVD-2020-0003
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Argument Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.9 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
redhatCNA
3.9 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
redhatansible
𝑥
≤ 2.7.16
redhatansible
2.8.0 ≤
𝑥
≤ 2.8.8
redhatansible
2.9.0 ≤
𝑥
≤ 2.9.5
redhatansible_tower
𝑥
≤ 3.3.4
redhatansible_tower
3.3.5 ≤
𝑥
≤ 3.4.5
redhatansible_tower
3.5.0 ≤
𝑥
≤ 3.5.5
redhatansible_tower
3.6.0 ≤
𝑥
≤ 3.6.3
redhatcloudforms_management_engine
5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ansible
bookworm
unimportant
bullseye
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ansible
bionic
needs-triage
eoan
ignored
focal
needs-triage
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
trusty
needs-triage
xenial
needs-triage