CVE-2024-9620: Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption
A flaw was found in Event-Driven Automation (EDA) in Ansible Automation Platform (AAP), which lacks encryption of sensitive information. An attacker with network access could exploit this vulnerability by sniffing the plaintext data transmitted between the EDA and AAP. An attacker with system access could exploit this vulnerability by reading the plaintext data stored in EDA and AAP databases.
Other sources
The Event-Driven Automation (EDA) in Ansible Automation Platform (AAP) in versions equal to or below 2.4 lacks encryption of sensitive information, such as ServiceNow's credentials on an integration. This vulnerability leaves sensitive data in plaintext, as the component does not use AAP's built-in encryption features like in AAP's Survey.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9620?
CVE-2024-9620 is classified as a high severity vulnerability due to the potential exposure of sensitive information through unencrypted communication.
How do I fix CVE-2024-9620?
To remediate CVE-2024-9620, ensure that all sensitive data transmitted between Event-Driven Automation (EDA) and Ansible Automation Platform (AAP) is encrypted.
Who is affected by CVE-2024-9620?
CVE-2024-9620 affects users of Red Hat Ansible Automation Platform versions up to and including 2.4.
What types of attacks can exploit CVE-2024-9620?
An attacker with network access could exploit CVE-2024-9620 by sniffing plaintext data being transmitted, leading to potential data breaches.
Is there a patch available for CVE-2024-9620?
Yes, Red Hat has released a patch for CVE-2024-9620 that includes encryption updates to secure sensitive information.