Vulnerability Description
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d
- https://github.com/ansibleguy/webui/files/15358522/Report.pdf
- https://github.com/ansibleguy/webui/issues/44
- https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj
- https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d
- https://github.com/ansibleguy/webui/files/15358522/Report.pdf
- https://github.com/ansibleguy/webui/issues/44
- https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj
FAQ
What is CVE-2024-36110?
CVE-2024-36110 is a vulnerability with a CVSS score of 8.2 (HIGH). ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus ...
How severe is CVE-2024-36110?
CVE-2024-36110 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-36110?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.