Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-1746

CVE-2020-1746: Exposure of Sensitive Information to an Unauthorized Actor in ansible

5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-1746
GHSA ID
GHSA-j2h6-73x8-22c4
EPSS Score
0.18492%
CWE
CWE-200
Published
4/20/2021
Updated
9/11/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ansiblepip>= 2.8.0a1, < 2.8.112.8.11
ansiblepip>= 2.9.0a1, < 2.9.72.9.7
ansiblepip>= 2.7.0a1, < 2.7.172.7.17

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from modules accepting a 'params' argument that circumvented Ansible's parameter handling. Both ldap_attr.py and ldap_entry.py's main functions merged user-provided 'params' into module parameters without proper security checks for 'bind_pw'. The patches removed 'params' and added explicit checks to block 'bind_pw' via this vector, confirming these functions were the exposure points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in t** *nsi*l* *n*in* *****tin* *nsi*l* *n*in* v*rsions *.*.x ***or* *.*.** *n* *.*.x ***or* *.*.** *n* *.*.x ***or* *.*.* *s w*ll *s *nsi*l* Tow*r ***or* *n* in*lu*in* v*rsions *.*.* *n* *.*.* *n* *.*.* w**n t** l**p_*ttr *n* l**p_*

Reasoning

T** vuln*r**ility st*mm** *rom mo*ul*s ****ptin* * 'p*r*ms' *r*um*nt t**t *ir*umv*nt** *nsi*l*'s p*r*m*t*r **n*lin*. *ot* l**p_*ttr.py *n* l**p_*ntry.py's m*in *un*tions m*r*** us*r-provi*** 'p*r*ms' into mo*ul* p*r*m*t*rs wit*out prop*r s**urity ***