Red Hat Ansible Automation Platform OAuth2 Privilege Escalation Vulnerability (CVE-2024-11483)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-11483 2. Release Date: November 20, 2024 3. Last Modified Date: November 20, 2024 4. Impact Level: Moderate 5. CVSS v3 Score: 5 6. Description: A vulnerability discovered in Ansible Automation Platform (AAP) that allows attackers to escalate privileges by improperly exploiting read-scoped OAuth2 tokens to gain write access. This vulnerability affects OAuth2 authentication for API endpoints relying on . 7. Additional Information: - Bugzilla ID: 2327579 - CWE ID: 284 8. Affected Packages and Red Hat Security Patches: - Red Hat Ansible Automation Platform 2 9. CVSS v3 Score Details: - CVSS v3 Base Score: 5 - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None 10. Frequently Asked Questions: - Why does Red Hat’s CVSS v3 score or impact differ from other vendors? - My product is listed as “under investigation” or “affected”—when will Red Hat release a fix for this vulnerability? - If my product is listed as “not fixed,” what should I do? - If my product is listed as “fix delayed,” what should I do? - What are mitigations? - I have a Red Hat product, but it’s not listed above—am I affected? - Why does my security scanner report my product is affected by this vulnerability, even though my product version is patched or not affected? This information provides a detailed description and scope of impact for the CVE-2024-11483 vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Ansible Automation Platform OAuth2 Privilege Escalation Vulnerability (CVE-2024-11483)

More from this source