Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update

Fixed packages 10

Vulnerabilities 1

• High 7.3
  CVE-2023-3971 Public exploit

  Controller: html injection in custom login info

  An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

  Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Red Hat Ansible Automation Platform 2.3 for RHEL 9
  Oct 4, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2226965
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4590.json
• report
  https://access.redhat.com/security/cve/CVE-2023-3971
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3971
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3971