redhat ansible-engine CVE-2020-14332 in Red Hat and Debian Products
Published on September 11, 2020

product logo product logo
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-14332 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Improper Output Neutralization for Logs

The software does not neutralize or incorrectly neutralizes output that is written to logs.


Products Associated with CVE-2020-14332

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-14332 are published in these products:

Red Hat Ansible Engine
 
Debian Linux
 

Affected Versions

Red Hat Ansible:

Exploit Probability

EPSS
0.15%
Percentile
35.34%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.