CVE-2020-1746

lowPriorität · verfolgen · 20EPSS 0.004 · 33. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.39% (33rd) EPSS

CVSS 1.9 · low

Is it mine?

40 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.9–5

v2.01.9lowAV:L/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.4 · Auswirkung 2.9

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.3 · Auswirkung 3.6

v3.15mediumAV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 1.3 · Auswirkung 3.6

v3.15mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:Nsecondary · OSV

v3.14.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200USCWE-200USCWE-200US

betroffene Produkte (40)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Open Source Ansible Tower 3.4.5alle Versionencert_bundDEcpe:/a:open_source:ansible_tower:3.4.5
Open Source Ansible Tower 3.5.5alle Versionencert_bundDEcpe:/a:open_source:ansible_tower:3.5.5
Open Source Ansible Tower 3.6.3alle Versionencert_bundDEcpe:/a:open_source:ansible_tower:3.6.3
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEalle Versionencert_bundDEcpe:/o:suse:opensuse:-
Red Hat Ansible≤ Ansible Tower ≤ 3.5.5enisa_euvdEU
Red Hat Ansible≤ ansible-engine versions 2.7.x before 2.7.17enisa_euvdEU
Red Hat Ansible≤ ansible-engine versions 2.8.x before 2.8.11enisa_euvdEU
Red Hat Ansible≤ ansible-engine versions 2.9.x before 2.9.7enisa_euvdEU
Red Hat Ansible≤ Ansible Tower ≤ 3.6.3enisa_euvdEU
Red Hat Ansible≤ Ansible Tower ≤ 3.4.5enisa_euvdEU
Red Hat Inc. Ansible2.7.0 → 2.7.17fstec_bduRU
Red Hat Inc. Ansible2.8.0 → 2.8.11fstec_bduRU
Red Hat Inc. Ansible2.9.0 → 2.9.7fstec_bduRU
Red Hat Inc. Ansible Tower3.3.5 → 3.4.5fstec_bduRU
Red Hat Inc. Ansible Tower3.5.0 → 3.5.5fstec_bduRU
Red Hat Inc. Ansible Tower3.6.0 → 3.6.3fstec_bduRU
АО «ИВК» Альт 8 СПalle Versionenfstec_bduRU

20 von 40 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2023-2472Ansible Tower: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2020-05-12csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Ansible Tower ausnutzen, um Informationen offenzulegen.
GHSA-j2h6-73x8-22c4Exposure of Sensitive Information to an Unauthorized Actor in ansible2021-04-20ghsa · osvUS
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the `bind_pw` in the parameters field. The highest threat from this vulnerability is data confidentiality.
PYSEC-2020-132020-05-12vendor · osvUS
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2020-05-12geändert 2026-06-17

Referenzen (16)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan