CVE-2022-3644

Published: Oct 25, 2022Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

Affected (4)

Products: Pulpproject: Pulp Ansible · Redhat: Ansible Automation Platform, Satellite, Update Infrastructure

Pulpproject

1 product

Pulp Ansible

Redhat

3 products

Ansible Automation Platform

Satellite

Update Infrastructure

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pulpproject Pulp Ansible	All versions

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Ansible Automation Platform	Version 2.0
Redhat Satellite	Version 6.0
Redhat Update Infrastructure	Version 3.0

Related CWEs

CWE-256

Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234

Source: secalert@redhat.com

ExploitThird Party Advisory

https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.