CVE-2024-9902Medium· 6.3▾ TwilightPoC availableansible-core Incorrect Authorization vulnerability
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.2%
0.2% → 0.3%
1 GitHub repo
Last analysed / modified upstream
A flaw was found in Ansible. The ansible-core user module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the user module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.
ansible-core < 2.14.18rc1ansible-core >= 2.15.0b1, < 2.15.13rc1ansible-core >= 2.16.0b1, < 2.16.13rc1ansible-core >= 2.17.0b1, < 2.17.6rc1ansible-core >= 2.18.0b1, < 2.18.0rc2Upgrade to a patched release:
ansible-core 2.14.18rc1ansible-core 2.15.13rc1ansible-core 2.16.13rc1ansible-core 2.17.6rc1ansible-core 2.18.0rc2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-8775Medium· 5.5A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook
CVE-2023-4237Medium· 6.5Ansible may expose private key
CVE-2023-5764Medium· 6.6Ansible template injection vulnerability
CVE-2024-11079Medium· 5.5A flaw was found in Ansible-Core
CVE-2026-11332High· 7.8A flaw was found in ansible-core