What is CVE-2020-14328?

CVE-2020-14328 is a low-severity vulnerability in Red Hat Ansible Tower, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.3/10. Published 2021-05-27.

How severe is CVE-2020-14328?

Low severity. CVSS v3 base score is 3.3 out of 10.

Is CVE-2020-14328 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Red Hat Ansible Tower

CVE-2020-14328

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.002 (15.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Redhat Ansible_tower
N/a Tower — versions ansible_tower 3.7.2

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

n0-traces/cve_

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-14328?: CVE-2020-14328 is a low-severity vulnerability in Red Hat Ansible Tower, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.3/10. Published 2021-05-27.
How severe is CVE-2020-14328?: Low severity. CVSS v3 base score is 3.3 out of 10.
Is CVE-2020-14328 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.