CVE-2014-3498
HighSummary
The user module in Ansible before version 1.6.6 allows remote authenticated users to execute arbitrary commands.
Risk Assessment
The ability for remote users to execute arbitrary commands can lead to serious security breaches and data loss within the organization.
Recommendation
It is recommended to upgrade Ansible to version 1.6.6 or later to mitigate this vulnerability.
Other vulnerabilities in Ansible
See all- CVE-2015-6240High
The chroot, jail, and zone connection plugins in Ansible before version 1.9.2 allow local users to escape a restricted environment via a symlink attack.
- CVE-2024-8775Medium
Ansible has a flaw where sensitive information stored in Ansible Vault files can be exposed in plaintext during playbook execution. This occurs when using tasks like include_vars without the no_log: true parameter, causing sensitive data to be printed in output or logs.
Original NVD description (English source)
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.