What’s Vulnerable › Vulnerabilities

CVE-2023-4380: Platform: token exposed at importing project

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-04 · updated 2026-06-17
• Weakness: CWE-532

Description

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Affected products

• Red Hat Ansible Automation Platform: 2.4
• RedHat Ansible Developer: 1.1
• RedHat Ansible Inside: 1.2

References

• https://access.redhat.com/errata/RHSA-2023:4693
• https://access.redhat.com/security/cve/CVE-2023-4380
• https://bugzilla.redhat.com/show_bug.cgi?id=2232324
• https://access.redhat.com/errata/RHSA-2023:4693
• https://access.redhat.com/security/cve/CVE-2023-4380
• https://bugzilla.redhat.com/show_bug.cgi?id=2232324

Get alerted when CVE-2023-4380 or the next vulnerability affects your stack