CVE-2023-4380 Platform: token exposed at importing project
Attackers can retrieve plaintext credentials from logs when creating private projects with incorrect credentials, leading to potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-4380?
CVE-2023-4380 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.4 for RHEL 8, published on 4 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.
Weakness: CWE-532
Which versions are affected by CVE-2023-4380?
It affects 3 products.
Products include Redhat Ansible Automation Platform, Redhat Ansible Developer, Redhat Ansible Inside.
How do I fix CVE-2023-4380?
Apply the vendor's patch.
Is CVE-2023-4380 being exploited?
There is no known exploitation of CVE-2023-4380 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 8
- CVE-2021-4112 Privilege escalation in ansible-tower
- CVE-2023-4237 Platform: ec2_key module prints out the private key directly to the standard output
- CVE-2021-3583 Improper Input Validation and Command Injection in Ansible
- CVE-2025-9907 Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
- CVE-2025-9908 Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
Sources
Also known as GHSA-2pfv-q6j2-pcrf, UBUNTU-CVE-2023-4380.