CVE-2020-14337 Information disclosure in Ansible Tower
Unauthenticated attackers can retrieve sensitive data and verify usernames via HTTP error codes in Ansible Tower.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14337?
CVE-2020-14337 is a medium-severity vulnerability in Redhat Ansible Tower, published on 31 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data confidentiality.
Weakness: CWE-209
Which versions are affected by CVE-2020-14337?
It affects 1 product.
Products include Redhat Ansible Tower.
How do I fix CVE-2020-14337?
No fix has been published for CVE-2020-14337 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-14337 being exploited?
There is no known exploitation of CVE-2020-14337 in the wild and no public exploit code.
Other vulnerabilities in Redhat Ansible Tower
Sources
Also known as GHSA-p8pw-f2qh-mrc2.