CVE-2023-3971
High
Description
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
SeverityHigh
CVSS7.3
Exploit probability—
Product
Redhat Ansible Automation Controller
PublishedOct 4, 2023
First seenOct 4, 2023
Weakness typeCWE-80CWE-80
How to fix
Update
- redhat ansible_automation_controller4.3.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat ansible_automation_controller | v < 4.3.11, 4.4 | 4.3.11 |
| redhat ansible_automation_platform | 2.3, 2.4 | — |
| redhat ansible_developer | 1.0 | — |
| redhat ansible_inside | 1.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.