-
Notifications
You must be signed in to change notification settings - Fork 206
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 1 new CVEs: CVE-2024-11483 - 2 updated CVEs: CVE-2024-2467, CVE-2024-9355
- Loading branch information
cvelistV5 Github Action
committed
Nov 25, 2024
1 parent
a2fb612
commit 3771687
Showing
5 changed files
with
159 additions
and
73 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,115 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-11483", | ||
| "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "redhat", | ||
| "dateReserved": "2024-11-20T08:09:27.275Z", | ||
| "datePublished": "2024-11-25T03:54:34.342Z", | ||
| "dateUpdated": "2024-11-25T03:54:34.342Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "title": "Automation-gateway: improper scope handling in oauth2 tokens for aap 2.5", | ||
| "metrics": [ | ||
| { | ||
| "other": { | ||
| "content": { | ||
| "value": "Moderate", | ||
| "namespace": "https://access.redhat.com/security/updates/classification/" | ||
| }, | ||
| "type": "Red Hat severity rating" | ||
| } | ||
| }, | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 5, | ||
| "baseSeverity": "MEDIUM", | ||
| "confidentialityImpact": "NONE", | ||
| "integrityImpact": "LOW", | ||
| "privilegesRequired": "LOW", | ||
| "scope": "CHANGED", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS" | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services." | ||
| } | ||
| ], | ||
| "affected": [ | ||
| { | ||
| "vendor": "Red Hat", | ||
| "product": "Red Hat Ansible Automation Platform 2", | ||
| "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", | ||
| "packageName": "automation-gateway", | ||
| "defaultStatus": "affected", | ||
| "cpes": [ | ||
| "cpe:/a:redhat:ansible_automation_platform:2" | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://access.redhat.com/security/cve/CVE-2024-11483", | ||
| "tags": [ | ||
| "vdb-entry", | ||
| "x_refsource_REDHAT" | ||
| ] | ||
| }, | ||
| { | ||
| "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2327579", | ||
| "name": "RHBZ#2327579", | ||
| "tags": [ | ||
| "issue-tracking", | ||
| "x_refsource_REDHAT" | ||
| ] | ||
| }, | ||
| { | ||
| "url": "https://github.com/ansible/django-ansible-base/commit/845b3e1838cc0762a7f9f3e0379c5274519d9a44" | ||
| } | ||
| ], | ||
| "datePublic": "2024-11-20T00:00:00+00:00", | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-284", | ||
| "description": "Improper Access Control", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "x_redhatCweChain": "CWE-284: Improper Access Control", | ||
| "timeline": [ | ||
| { | ||
| "lang": "en", | ||
| "time": "2024-11-20T08:03:10.145000+00:00", | ||
| "value": "Reported to Red Hat." | ||
| }, | ||
| { | ||
| "lang": "en", | ||
| "time": "2024-11-20T00:00:00+00:00", | ||
| "value": "Made public." | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", | ||
| "shortName": "redhat", | ||
| "dateUpdated": "2024-11-25T03:54:34.342Z" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters