Auth bypass in Red Hat Ansible Tower
CVE-2020-10709
A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6.
Vulnerability class: Broken Authentication
EPSS: 0.003 (19.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Redhat Ansible_tower
- N/a Tower — versions ansible_tower 3.6.4, ansible_tower 3.5.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-10709?
- CVE-2020-10709 is a high-severity vulnerability in Red Hat Ansible Tower, classified under Improper Authentication. CVSS score: 7.1/10. Published 2021-05-27.
- How severe is CVE-2020-10709?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2020-10709 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.