A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| ansible automation platform | 2.5 | — | |
| ansible automation platform | 2.6 | — | |
| ansible automation platform developer | 2.5 | — | |
| ansible automation platform developer | 2.6 | — | |
| ansible automation platform inside | 2.5 | — | |
| ansible automation platform inside | 2.6 | — | |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | all versions | |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | all versions | |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | all versions | |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | all versions | |
| — | automation-controller | 4.6.0 – < 4.6.28, 4.7.0 – < 4.7.11 | |
| — | automation-gateway | 2.5.0 – < 2.5.20260422, 2.6.0 – < 2.6.20260422 | |
| — | django-ansible-base | 2.5.0 – < 2.5.20260422, 2.6.0 – < 2.6.20260422 |
Ücretsiz ve açık kaynak honeypot sensörümüz, sunucunuzun kullanmadığı portlarda bekler; bağlanan tarayıcıları ve saldırganları ortak kara listeye bildirir.
