← Back

CVE-2020-1736

nvd nist
Published: Mar 16, 2020Modified: Nov 21, 2024

JSON object

Loading...
3.3
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.8 / Impact: 1.4
Source: NVD

Description

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Affected (12)

Redhat
4 products
Ansible
Ansible Tower
Cloudforms Management Engine
Openstack
Fedoraproject
1 product
Fedora
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Ansible
Up to 2.7.16
Ansible
From 2.8.0 to 2.8.15
Ansible
From 2.9.0 to 2.9.13
Redhat
Ansible Tower
Up to 3.3.4
Ansible Tower
From 3.3.5 to 3.4.5
Ansible Tower
From 3.5.0 to 3.5.5
Ansible Tower
From 3.6.0 to 3.6.3
Ansible Tower
From 3.7.0 to 3.7.2
Cloudforms Management Engine
Version 5.0
Openstack
Version 13
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 31
Fedora
Version 32

Related CWEs

CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (10)

Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
ExploitIssue TrackingThird Party Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.