What is CVE-2019-14890?

CVE-2019-14890 is a high-severity vulnerability in [Unknown] Tower, classified under Cleartext Storage of Sensitive Information. CVSS score: 8.4/10. Published 2019-11-26.

How severe is CVE-2019-14890?

High severity. CVSS v3 base score is 8.4 out of 10.

Vulnerability in [Unknown] Tower

CVE-2019-14890

A vulnerability was found in Ansible Tower before 3.6.1 where an attacker with low privilege could retrieve usernames and passwords credentials from the new RHSM saved in plain text into the database at '/api/v2/config' when applying the Ansible Tower license.

Published 2019-11-26 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.002 (14.8th percentile), scored 2026-11-01.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 14.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

[Unknown] Tower — versions 3.6.1
Red Hat Ansible Tower — versions 3.6.0

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

References

bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2019-14890?: CVE-2019-14890 is a high-severity vulnerability in [Unknown] Tower, classified under Cleartext Storage of Sensitive Information. CVSS score: 8.4/10. Published 2019-11-26.
How severe is CVE-2019-14890?: High severity. CVSS v3 base score is 8.4 out of 10.