high8.8
CVE-2023-39059
Code injection in ansible semaphore
Impact
An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ansible-semaphore/semaphore | <= 2.8.90 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ansible-Semaphore | Ansible Semaphore | Version 2.8.90 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/Alevsk/1757da24c5fb8db735d392fd4146ca3a
- https://www.alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations/
- https://github.com/advisories/GHSA-3r32-cp7v-5wq4
- https://nvd.nist.gov/vuln/detail/CVE-2023-39059
- https://www.alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations