CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2020-14332
Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in ansible 2.10.1rc2, 2.8.14, 2.9.12.
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-117, CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- redhat:ansible_engine
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j667-c2hm-f2wp | PyPI | ansible | <2.8.14 | 2.8.14 |
| GHSA-j667-c2hm-f2wp | PyPI | ansible | >=2.9.0a1 <2.9.12 | 2.9.12 |
| GHSA-j667-c2hm-f2wp | PyPI | ansible | >=2.10.0a1 <2.10.1rc2 | 2.10.1rc2 |
| PYSEC-2020-4 | PyPI | ansible | >=2.8.0 <2.8.14 >=2.9.0 <2.9.12 | 2.8.14, 2.9.12 |