A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

nginx: HTTP request smuggling in configurations with URL redirect used as error_page jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods python-autobahn: allows redirect header injection ansible-tower: Privilege escalation via job isolation escape

Ein lokaler oder entfernter Angreifer kann mehrere Schwachstellen in Ansible Tower ausnutzen, um Informationen offenzulegen oder seine Privilegien zu erweitern.