CVE-2019-3828

2019-03-2700:00:00

CWE-22

redhat

www.cve.org

4.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Ansible",
    "versions": [
      {
        "version": "2.5.15",
        "status": "affected"
      },
      {
        "version": "2.6.14",
        "status": "affected"
      },
      {
        "version": "2.7.8",
        "status": "affected"
      }
    ]
  }
]