Vulnerability Name:

CVE-2020-10709 (CCN-202723)

Assigned:2020-03-20
Published:2021-04-20
Updated:2022-10-21
Summary:A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6.
CVSS v3 Severity:7.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
6.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
4.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
3.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.6 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
3.2 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-287
CWE-613
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2020-10709

Source: CCN
Type: Red Hat Bugzilla – Bug 1824033
(CVE-2020-10709) - CVE-2020-10709 Tower: OAuth2 refresh tokens do not respect the expiration

Source: MISC
Type: Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1824033

Source: XF
Type: UNKNOWN
ansible-cve202010709-sec-bypass(202723)

Source: CCN
Type: Ansible Web site
Ansible is Simple IT Automation

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-10709

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:ansible_tower:*:*:*:*:*:*:*:* (Version >= 3.6.0 and < 3.6.4)
  • OR cpe:/a:redhat:ansible_tower:*:*:*:*:*:*:*:* (Version < 3.5.6)

    • Configuration CCN 1:
  • cpe:/a:redhat:ansible_tower:3.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_tower:3.5.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    redhat ansible tower *
    redhat ansible tower *
    redhat ansible tower 3.6.3
    redhat ansible tower 3.5.5