CVE-2024-1657

{"id": "CVE-2024-1657", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-04-25T17:15:48.013", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:1057", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1657", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265085", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1057", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/security/cve/CVE-2024-1657", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265085", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-1385"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the ansible automation platform. An insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. An attacker that has access to any machine in the CIDR block could download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en the ansible automation platform. Se estaba utilizando una conexi\u00f3n WebSocket insegura en la instalaci\u00f3n desde el servidor EDA del libro de reglas de Ansible. Un atacante que tenga acceso a cualquier m\u00e1quina en el bloque CIDR podr\u00eda descargar todos los datos del libro de reglas del WebSocket, lo que resultar\u00eda en la p\u00e9rdida de confidencialidad e integridad del sistema."}], "lastModified": "2024-11-21T08:51:01.173", "sourceIdentifier": "secalert@redhat.com"}