CVE-2018-1101

High

Description

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.

SeverityHigh

CVSS7.2

Exploit probability—

Product

Redhat Ansible Tower

PublishedMay 2, 2018

First seenMay 2, 2018

Weakness typeCWE-266CWE-266

How to fix

Update

redhat ansible_tower3.2.4 or later

Vendor advisories

access.redhat.com/errata/RHSA-2018:1972
access.redhat.com/errata/RHSA-2018:1328

Affected products

Product	Affected versions	Fixed in
redhat ansible_tower	v < 3.2.4	3.2.4
redhat cloudforms	4.5, 4.6	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.