Vulnerability Description
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible Tower | >= 3.5.0, < 3.5.3 |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19340Issue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19340Issue TrackingVendor Advisory
FAQ
What is CVE-2019-19340?
CVE-2019-19340 is a vulnerability with a CVSS score of 8.2 (HIGH). A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ managem...
How severe is CVE-2019-19340?
CVE-2019-19340 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-19340?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible Tower, Redhat Enterprise Linux.