high7.3
CVE-2023-3971
An HTML injection flaw was found in Controller in the user interface settings.
Impact
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Ansible Automation Controller | before 4.3.11 Version 4.4 |
| Redhat | Ansible Automation Platform | Versions 2.3, 2.4 |
| Redhat | Ansible Developer | Version 1.0 |
| Redhat | Ansible Inside | Version 1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2023:4340
- https://access.redhat.com/errata/RHSA-2023:4590
- https://access.redhat.com/security/cve/CVE-2023-3971
- https://bugzilla.redhat.com/show_bug.cgi?id=2226965
- https://access.redhat.com/errata/RHSA-2023:4340
- https://access.redhat.com/errata/RHSA-2023:4590
- https://access.redhat.com/security/cve/CVE-2023-3971
- https://bugzilla.redhat.com/show_bug.cgi?id=2226965