VulnerabilityDeferred

CVE-2024-9620

An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP.

MEDIUM 5.3EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.16% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-319
Source: secalert@redhat.com

References

https://access.redhat.com/security/cve/CVE-2024-9620
https://bugzilla.redhat.com/show_bug.cgi?id=2317129

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.