1. Home
  2. CVE Database
  3. CVE-2022-3697
HIGH · 7.5

CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue a...

Vulnerability Description

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
RedhatAnsible>= 2.5.0, < 2.10.0
RedhatAnsible Collection< 2.0.0

Related Weaknesses (CWE)

CWE-233

References

FAQ

What is CVE-2022-3697?

CVE-2022-3697 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue a...

How severe is CVE-2022-3697?

CVE-2022-3697 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-3697?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible, Redhat Ansible Collection.