Every CVE Search/ Get API key

CVE-2023-3971

Controller: html injection in custom login info

7.3 HighPublic exploitFix available

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.82%Up 0.8 points since Oct 5, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.3

Controller: html injection in custom login info

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Record
CVE-2023-3971
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-80
Updated
2026-11-07
EUVDEUVD-2023-44596 7.3

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Record
EUVD-2023-44596
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-07
GitHub AdvisoriesGHSA-p5xq-xr8f-3wj4 7.3

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows...

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Record
GHSA-p5xq-xr8f-3wj4
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-79, CWE-80
Updated
2026-11-02
NVD 7.3

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Record
CVE-2023-3971
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-80, CWE-79
Updated
2026-11-07
OSVRHSA-2023:4340 7.3

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record
RHSA-2023:4340
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2023:4590 7.3

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update

Record
RHSA-2023:4590
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automation-controller
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.4.1-1.el8ap
0:4.4.1-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.4.1-1.el8ap
0:4.4.1-1.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.4.1-1.el8ap
0:4.4.1-1.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.4.1-1.el8ap
0:4.4.1-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.4::el8
 before 0:4.4.1-1.el8ap
0:4.4.1-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.4.1-1.el9ap
0:4.4.1-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.4.1-1.el9ap
0:4.4.1-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.4.1-1.el9ap
0:4.4.1-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.4.1-1.el9ap
0:4.4.1-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.4::el9
 before 0:4.4.1-1.el9ap
0:4.4.1-1.el9ap
Show 10 moreShow less
Affected packages
PackageAffectedFixed
automation-controller
Red Hat:ansible_automation_platform:2.3::el8
 before 0:4.3.11-1.el8ap
0:4.3.11-1.el8ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.3::el8
 before 0:4.3.11-1.el8ap
0:4.3.11-1.el8ap
automation-controller-server
Red Hat:ansible_automation_platform:2.3::el8
 before 0:4.3.11-1.el8ap
0:4.3.11-1.el8ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.3::el8
 before 0:4.3.11-1.el8ap
0:4.3.11-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.3::el8
 before 0:4.3.11-1.el8ap
0:4.3.11-1.el8ap
automation-controller
Red Hat:ansible_automation_platform:2.3::el9
 before 0:4.3.11-1.el9ap
0:4.3.11-1.el9ap
automation-controller-cli
Red Hat:ansible_automation_platform:2.3::el9
 before 0:4.3.11-1.el9ap
0:4.3.11-1.el9ap
automation-controller-server
Red Hat:ansible_automation_platform:2.3::el9
 before 0:4.3.11-1.el9ap
0:4.3.11-1.el9ap
automation-controller-ui
Red Hat:ansible_automation_platform:2.3::el9
 before 0:4.3.11-1.el9ap
0:4.3.11-1.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.3::el9
 before 0:4.3.11-1.el9ap
0:4.3.11-1.el9ap

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubashangp923/CVE-2023-39712023-10-20

History

History
RecordedChangedSources
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-3971 is a high vulnerability (CVSS 7.3) in Red Hat Ansible Automation Platform 2.3 For Rhel 8, published October 4, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in automation-controller 0:4.4.1-1.el8ap.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open