CVE-2017-7550
CriticalSummary
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs.
Risk Assessment
This vulnerability could lead to the exposure of confidential data, posing a serious security threat to the organization.
Recommendation
It is recommended to update Ansible to version 2.3.3 or 2.4.1 to mitigate this vulnerability and to review the module documentation to avoid further issues.
Original NVD description (English source)
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.