{"cve":"CVE-2018-16879","nvd":{"published":"2019-01-03T14:29:00.197","modified":"2026-06-17T01:44:58.797","status":"Modified","description":"Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-311"],"references":["http://www.securityfocus.com/bid/106310","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879","http://www.securityfocus.com/bid/106310","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16879"],"products":["redhat:ansible_tower"],"source":"nvd","synced_at":"2026-10-19T20:54:36.112582389+00:00"},"epss":{"cve":"CVE-2018-16879","score":0.0111,"percentile":0.65922,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}