What is CVE-2020-14337?

CVE-2020-14337 is a medium-severity vulnerability in Red Hat Ansible Tower, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 5.8/10. Published 2020-07-31.

How severe is CVE-2020-14337?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Information disclosure in Red Hat Ansible Tower

CVE-2020-14337

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data confidentiality.

EPSS: 0.015 (71.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Redhat Ansible_tower — versions 3.0.0
N/a Ansible Tower — versions Ansible Tower 3.7.1 as well as previous versions are affected.

Weakness classification (CWE)

CWE-209 — Generation of Error Message Containing Sensitive Information

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-14337?: CVE-2020-14337 is a medium-severity vulnerability in Red Hat Ansible Tower, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 5.8/10. Published 2020-07-31.
How severe is CVE-2020-14337?: Medium severity. CVSS v3 base score is 5.8 out of 10.