nvd-json-data-feeds/CVE-2023/CVE-2023-57xx/CVE-2023-5764.json

{
  "id": "CVE-2023-5764",
  "sourceIdentifier": "secalert@redhat.com",
  "published": "2023-12-12T22:15:22.747",
  "lastModified": "2024-09-16T17:16:01.667",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una falla de inyecci\u00f3n de plantilla en Ansible donde las operaciones de creaci\u00f3n de plantillas internas del controlador de un usuario pueden eliminar la designaci\u00f3n insegura de los datos de la plantilla. Este problema podr\u00eda permitir que un atacante utilice un archivo especialmente manipulado para introducir la inyecci\u00f3n de c\u00f3digo al proporcionar datos de plantillas."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      },
      {
        "source": "secalert@redhat.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    },
    {
      "source": "secalert@redhat.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.14.12",
              "matchCriteriaId": "5995DC14-0DBB-4784-B57D-21F850D4CE63"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.15.0",
              "versionEndExcluding": "2.15.7",
              "matchCriteriaId": "4212FD6E-7D15-403C-9B4B-48F348F18501"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible:2.16.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "D717EC3B-C9C9-49C5-B64B-58A46A6A99B4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible:2.16.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "B01E3989-78A3-4CD3-9F6B-CD5AF3559365"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible:2.16.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "D109D9B1-B465-4708-BC0C-134AF8D81BB9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible:2.16.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "90BA6AD3-1627-46DA-9972-96A567EC17A1"
            }
          ]
        }
      ]
    },
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB176AC3-3CDA-4DDA-9089-C67B2F73AA62"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "05986E3C-7E5B-45C1-81B0-9D856A8FF1CC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CEE40363-D286-4EB7-80D2-17CF3B606AD6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "897AB7AC-52B1-4335-97D5-D5EA2FF09CC6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2023:7773",
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2023-5764",
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247629",
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}