Vulnerability in Red Hat Ansible Automation Platform 2.5 For Rhel 8
CVE-2024-11483
A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.
EPSS: 0.005 (40.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N.
Affected products
- Red Hat Ansible Automation Platform 2.5 For Rhel 8 — versions 0:2.5.20241218-1.el8ap
- Red Hat Ansible Automation Platform 2.5 For Rhel 9 — versions 0:2.5.20241218-1.el9ap
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
- secalert@redhat.com
Frequently asked questions
- What is CVE-2024-11483?
- CVE-2024-11483 is a medium-severity vulnerability in Red Hat Ansible Automation Platform 2.5 For Rhel 8, classified under Improper Access Control. CVSS score: 5.0/10. Published 2024-11-25.
- How severe is CVE-2024-11483?
- Medium severity. CVSS v3 base score is 5.0 out of 10.