Ansible AAP EDA Lack of Encryption Vulnerability CVE-2024-9620

Key Information Vulnerability Description CVE Number: CVE-2024-9620 Vulnerability Name: Event-Driven Automation (EDA) in Ansible Automation Platform (AAP) lacks encryption Description: A vulnerability has been identified in the Event-Driven Automation (EDA) component of Ansible Automation Platform (AAP), where sensitive information is not encrypted. Attackers can exploit this vulnerability by sniffing plaintext data transmitted between EDA and AAP. Additionally, attackers can exploit this vulnerability by reading plaintext data stored in the EDA and AAP databases. Affected Scope Affected Versions: Versions 2.4 and earlier Affected Component: EDA Affected Platform: Linux Impact Level Severity: Medium Priority: Medium Reporting Information Report Date: October 8, 2024 Reporter: OSIDB Bzimport Remediation Status Remediation Status: Not fixed Fixed Version: Not specified Additional Information Keywords: Security Status: New Product: Security Response Target Milestone: Not specified Assigned To: Product Security DevOps Team Document Type: Document Document Description: Detailed description of the vulnerability discovery and its impact. Summary This vulnerability arises from the lack of encryption for sensitive information in the Event-Driven Automation (EDA) component of Ansible Automation Platform (AAP) in versions 2.4 and earlier. Attackers can exploit this vulnerability through network access or system access to steal sensitive data. The severity and priority of this vulnerability are both rated as medium, but it remains unfixed at this time.

Goal Reached Thanks to every supporter — we hit 100%!

Ansible AAP EDA Lack of Encryption Vulnerability CVE-2024-9620