What’s Vulnerable › Vulnerabilities

CVE-2024-11483: Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-25 · updated 2026-06-17
• Weakness: CWE-284

Description

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Affected products

• Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 0:2.5.20241218-1.el8ap
• Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 0:2.5.20241218-1.el9ap

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20241218-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20241218-1.el9ap. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:11145
• https://access.redhat.com/security/cve/CVE-2024-11483
• https://bugzilla.redhat.com/show_bug.cgi?id=2327579
• https://github.com/ansible/django-ansible-base/commit/845b3e1838cc0762a7f9f3e0379c5274519d9a44

Get alerted when CVE-2024-11483 or the next vulnerability affects your stack