Advisories · Technology
Red Hat Ansible Automation Platform 2.5.
Every CVE that names Red Hat Ansible Automation Platform 2.5 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Broken access control
- CVSS 6.4 Medium
Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions
- Red Hat Ansible Automation Platform 2.16
- Red Hat Ansible Automation Platform 2.18
- Broken access control
- CVSS 6.7 Medium
Aap-gateway: improper path validation in gateway allows credential exfiltration
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-647
- CVSS 6.7 Medium
Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Information disclosure
- CVSS 6.7 Medium
Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Information disclosure
- CVSS 8.5 High
Ansible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictions
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- CWE-279