CVE-2023-5115

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5115
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:5701 Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5758 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-5115 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2233810 Issue Tracking
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:redhat:ansible_inside:1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:a:redhat:ansible_developer:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

16 Sep 2024, 15:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}

29 Dec 2023, 17:57

Type Values Removed Values Added
CWE CWE-22
CPE cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_inside:1.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible_developer:1.0:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.3
References
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:5758 - () https://access.redhat.com/errata/RHSA-2023:5758 - Vendor Advisory
References () https://access.redhat.com/security/cve/CVE-2023-5115 - () https://access.redhat.com/security/cve/CVE-2023-5115 - Vendor Advisory
References () https://access.redhat.com/errata/RHSA-2023:5701 - () https://access.redhat.com/errata/RHSA-2023:5701 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2233810 - () https://bugzilla.redhat.com/show_bug.cgi?id=2233810 - Issue Tracking

18 Dec 2023, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-18 14:15

Updated : 2024-09-16 15:15

NVD link : CVE-2023-5115

Mitre link : CVE-2023-5115

CVE.ORG link : CVE-2023-5115

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • ansible_automation_platform
  • ansible_developer
  • ansible_inside
  • enterprise_linux
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')