Ansible Engine

Vendor:

First CVE: Mar 13, 2018 · Active for 8 years

25

Total CVEs

More Total CVEs than 96% of tracked products

5.0

Avg CVEs / Year

Higher CVE frequency than 89% of tracked products

6.5

Avg CVSS

Higher Avg CVSS than 33% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Ansible Engine over time

Volume of CVEsAvg CVSS Base Score

First CVE

Mar 13, 2018

8 years ago

Most Recent CVE

Mar 3, 2022

1,607 days ago

CVE Severity & Scoring

Ansible Engine25 CVEs

56%

36%

All CVEs352,785 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local19 (76.0%)

Network6 (24.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low22 (88.0%)

High3 (12.0%)

Unknown0 (0.0%)

User Interaction

None23 (92.0%)

Unknown0 (0.0%)

Required2 (8.0%)

Privileges Required

Low18 (72.0%)

High3 (12.0%)

None4 (16.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (25 CVEs).

25 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2018-7750CRITICAL transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2	Mar 13, 2018	9.8	56	NO	YES
CVE-2017-7481CRITICAL Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Un	Jul 19, 2018	9.8	33	NO	NO
CVE-2019-14846HIGH In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of cred	Oct 8, 2019	7.8	26	NO	NO
CVE-2021-20228HIGH A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the bas	Apr 29, 2021	7.5	25	NO	NO
CVE-2018-16837HIGH Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a paramete	Oct 23, 2018	7.8	25	NO	NO
CVE-2018-10875HIGH A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attac	Jul 13, 2018	7.8	25	NO	NO
CVE-2018-10874HIGH In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary	Jul 2, 2018	7.8	25	NO	NO
CVE-2020-14365HIGH A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures	Sep 23, 2020	7.1	24	NO	NO
CVE-2021-3620MEDIUM A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error mess	Mar 3, 2022	5.5	21	NO	NO
CVE-2019-14905MEDIUM A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used t	Mar 31, 2020	5.6	21	NO	NO

View all 25 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (25 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

1 CVE

4.0% of CVEs· 85th percentile

Social Chatter

Signals from CVEs in this product scope (25 CVEs).

Media Mentions

Signals from CVEs in this product scope (25 CVEs).

Top CNAs Publishing CVEs For Ansible Engine

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
2.9.5	1	7.4	0.4%	0
2.9.18	1	7.5	2.0%	0
2.9	1	7.5	2.0%	0
2.8.8	1	7.4	0.4%	0
2.8.0	1	7.8	0.5%	0
2.7	2	6.5	1.4%	0
2.6	4	7.2	1.0%	0
2.5	4	7.2	1.0%	0
2.4	3	8.5	9.4%	1
2.0	8	7.5	4.6%	1