CVE-2024-9620

{"id": "CVE-2024-9620", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-10-08T17:15:57.357", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-9620", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317129", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en la automatizaci\u00f3n basada en eventos (EDA) en Ansible Automation Platform (AAP), que carece de cifrado de informaci\u00f3n confidencial. Un atacante con acceso a la red podr\u00eda aprovechar esta vulnerabilidad al rastrear los datos de texto sin formato transmitidos entre EDA y AAP. Un atacante con acceso al sistema podr\u00eda aprovechar esta vulnerabilidad al leer los datos de texto sin formato almacenados en las bases de datos de EDA y AAP."}], "lastModified": "2024-10-10T12:56:30.817", "sourceIdentifier": "secalert@redhat.com"}