Vulnerability Details CVE-2017-7550
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 63.2%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
Products affected by CVE-2017-7550
-
cpe:2.3:a:redhat:ansible:2.3.0.0-0.4.rc4
-
cpe:2.3:a:redhat:ansible:2.3.0.0-0.5.rc5
-
cpe:2.3:a:redhat:ansible:2.3.0.0-0.6.rc6
-
cpe:2.3:a:redhat:ansible:2.3.0.0-1
-
cpe:2.3:a:redhat:ansible:2.3.1.0-0.1.rc1
-
cpe:2.3:a:redhat:ansible:2.3.1.0-0.2.rc2
-
cpe:2.3:a:redhat:ansible:2.3.1.0-1
-
cpe:2.3:a:redhat:ansible:2.3.2.0-0.1.rc1
-
cpe:2.3:a:redhat:ansible:2.3.2.0-0.2.rc2
-
cpe:2.3:a:redhat:ansible:2.3.2.0-0.3.rc3
-
cpe:2.3:a:redhat:ansible:2.3.2.0-0.4.rc4
-
cpe:2.3:a:redhat:ansible:2.3.2.0-0.5.rc5
-
cpe:2.3:a:redhat:ansible:2.3.2.0-1
-
cpe:2.3:a:redhat:ansible:2.4.0.0-0.1.rc1
-
cpe:2.3:a:redhat:ansible:2.4.0.0-0.2.rc2
-
cpe:2.3:a:redhat:ansible:2.4.0.0-0.3.rc3
-
cpe:2.3:a:redhat:ansible:2.4.0.0-0.4.rc4
-
cpe:2.3:a:redhat:ansible:2.4.0.0-0.5
-
cpe:2.3:a:redhat:ansible:2.4.0.0-1
-
cpe:2.3:o:redhat:enterprise_linux_server:7.0