Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2018:1328 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2018:1972 | Third Party Advisory |
https://access.redhat.com/security/cve/cve-2018-1101 | Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=1563492 | Issue Tracking Third Party Advisory |
https://www.ansible.com/security | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2018-04-27T00:00:00
Updated: 2018-07-09T15:57:01
Reserved: 2017-12-04T00:00:00
Link: CVE-2018-1101
JSON object: View
NVD Information
Status : Modified
Published: 2018-05-02T18:29:00.717
Modified: 2019-10-09T23:38:06.570
Link: CVE-2018-1101
JSON object: View
Redhat Information
No data.