cve.bz

CVE-2020-10684

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in ansible 2.7.17, 2.8.11, 2.8.9.

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

Severity

CVSS 3.1

7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS
0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWEs
CWE-862, CWE-94, CWE-362
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-p62g-jhg6-v3rqPyPIansible>=2.7.0a1 <2.7.172.7.17
GHSA-p62g-jhg6-v3rqPyPIansible>=2.8.0a1 <2.8.112.8.11
GHSA-p62g-jhg6-v3rqPyPIansible>=2.9.0a1 <2.9.72.9.7
PYSEC-2020-207PyPIansible>=2.7.0 <2.7.17
>=2.8.0 <2.8.9
>=2.9.0 <2.9.6		2.7.17, 2.8.9, 2.9.6

References

Check your stackJSON