CVE-2019-19342

CVE-2019-19342 is a medium-severity vulnerability affecting Ansible Tower versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4. This flaw occurs when a password containing a '#' character is used in a /websocket request, leading to a RabbitMQ socket error and an HTTP 500 response. The vulnerability results in partial plaintext disclosure of the password, enabling attackers to potentially guess or brute-force credentials. The attack vector is network-based with low attack complexity, requiring no user interaction. While the impact is limited to partial password disclosure (Confidentiality Low), it could compromise authentication. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage for this CVE.