Every CVE Search/ Get API key

CVE-2023-4380

Platform: token exposed at importing project

6.3 Medium

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.64%Up 0.6 points since Oct 5, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.3

Platform: token exposed at importing project

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Record
CVE-2023-4380
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-532
Updated
2026-11-02
EUVDEUVD-2023-54244 6.3

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Record
EUVD-2023-54244
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-2pfv-q6j2-pcrf 6.3

A logic flaw exists in Ansible. Whenever a private project is created with incorrect credentials,...

A logic flaw exists in Ansible. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Record
GHSA-2pfv-q6j2-pcrf
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-532
Updated
2026-11-02
NVD 6.3

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Record
CVE-2023-4380
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-532
Updated
2026-11-02
OSVRHSA-2023:4693 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Record
RHSA-2023:4693
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-4380 6.3

A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Record
UBUNTU-CVE-2023-4380
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automation-eda-controller
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:1.0.1-1.el8ap
0:1.0.1-1.el8ap
automation-eda-controller-server
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:1.0.1-1.el8ap
0:1.0.1-1.el8ap
automation-eda-controller-ui
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:1.0.1-1.el8ap
0:1.0.1-1.el8ap
automation-eda-controller
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:1.0.1-1.el9ap
0:1.0.1-1.el9ap
automation-eda-controller-server
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:1.0.1-1.el9ap
0:1.0.1-1.el9ap
automation-eda-controller-ui
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:1.0.1-1.el9ap
0:1.0.1-1.el9ap
python39-cryptography
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python39-cryptography-debuginfo
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python3x-cryptography
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python3x-cryptography-debugsource
Red Hat:ansible_automation_platform_developer:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
Show 40 moreShow less
Affected packages
PackageAffectedFixed
python39-cryptography
Red Hat:ansible_automation_platform_inside:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python39-cryptography-debuginfo
Red Hat:ansible_automation_platform_inside:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python3x-cryptography
Red Hat:ansible_automation_platform_inside:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python3x-cryptography-debugsource
Red Hat:ansible_automation_platform_inside:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python39-cryptography
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python39-cryptography-debuginfo
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python3x-cryptography
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python3x-cryptography-debugsource
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el8ap
0:38.0.4-2.el8ap
python-cryptography
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python-cryptography-debugsource
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python3-cryptography
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python3-cryptography-debuginfo
Red Hat:ansible_automation_platform_developer:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python-cryptography
Red Hat:ansible_automation_platform_inside:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python-cryptography-debugsource
Red Hat:ansible_automation_platform_inside:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python3-cryptography
Red Hat:ansible_automation_platform_inside:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python3-cryptography-debuginfo
Red Hat:ansible_automation_platform_inside:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python-cryptography
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python-cryptography-debugsource
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python3-cryptography
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python3-cryptography-debuginfo
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:38.0.4-2.el9ap
0:38.0.4-2.el9ap
python39-requests
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:2.31.0-1.el8ap
0:2.31.0-1.el8ap
python3x-requests
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:2.31.0-1.el8ap
0:2.31.0-1.el8ap
python39-django
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:3.2.20-1.el8ap
0:3.2.20-1.el8ap
python3x-django
Red Hat:ansible_automation_platform:2.4::el8
From an advisory covering 4 CVEs
 before 0:3.2.20-1.el8ap
0:3.2.20-1.el8ap
python-django
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:3.2.20-1.el9ap
0:3.2.20-1.el9ap
python3-django
Red Hat:ansible_automation_platform:2.4::el9
From an advisory covering 4 CVEs
 before 0:3.2.20-1.el9ap
0:3.2.20-1.el9ap
ansible
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-1
Show 5 moreShow less
1.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm11.5.4+dfsg-1ubuntu0.1~esm21.5.4+dfsg-1ubuntu0.1~esm3
 None known
ansible
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.9.2+dfsg-21.9.4-12.0.0.2-22.0.0.2-2ubuntu12.0.0.2-2ubuntu1.1
Show 8 moreShow less
2.0.0.2-2ubuntu1.22.0.0.2-2ubuntu1.32.0.0.2-2ubuntu1.3+esm12.0.0.2-2ubuntu1.3+esm22.0.0.2-2ubuntu1.3+esm32.0.0.2-2ubuntu1.3+esm42.0.0.2-2ubuntu1.3+esm52.0.0.2-2ubuntu1.3+esm6
 None known
ansible
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.3.1.0+dfsg-22.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-1ubuntu0.12.5.1+dfsg-1ubuntu0.1+esm1
Show 4 moreShow less
2.5.1+dfsg-1ubuntu0.1+esm22.5.1+dfsg-1ubuntu0.1+esm32.5.1+dfsg-1ubuntu0.1+esm42.5.1+dfsg-1ubuntu0.1+esm5
 None known
ansible
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.8.3+dfsg-12.8.6+dfsg-12.9.2+dfsg-12.9.4+dfsg-12.9.6+dfsg-12.9.6+dfsg-1ubuntu0.1~esm12.9.6+dfsg-1ubuntu0.1~esm22.9.6+dfsg-1ubuntu0.1~esm3
 None known
ansible-core
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.12.0-12.12.0-1ubuntu0.1
 None known
ansible
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.10.7+merged+base+2.10.8+dfsg-12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4
 None known
ansible
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.7.0+dfsg-17.7.0+dfsg-39.2.0+dfsg-0ubuntu49.2.0+dfsg-0ubuntu5
 None known
ansible-core
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.14.9-22.14.11-12.14.11-22.14.13-12.16.3-0ubuntu12.16.3-0ubuntu2
 None known
ansible
Ubuntu:25.10
 All versions, plus listed versions
11.2.0+dfsg-112.0.0~a2+dfsg-112.0.0~a4+dfsg-112.0.0~a6+dfsg-112.0.0~b1+dfsg-1
 None known
ansible-core
Ubuntu:25.10
 All versions, plus listed versions
2.18.1-4ubuntu12.19.0~beta4-1ubuntu12.19.0-1ubuntu1
 None known
ansible
Ubuntu:26.10
 All versions, plus listed versions
13.1.0+dfsg-1ubuntu113.4.0+dfsg-1
 None known
ansible-core
Ubuntu:26.10
 All versions, plus listed versions
2.20.1-12.21.1~rc1-12.21.1~rc1-22.21.1~rc1-2ubuntu12.22.0~beta2-1
 None known
ansible
Ubuntu:26.04:LTS
 All versions, plus listed versions
12.0.0~b1+dfsg-112.0.0+dfsg-112.2.0+dfsg-113.1.0+dfsg-113.1.0+dfsg-1ubuntu1
 None known
ansible-core
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.19.0-1ubuntu12.19.4-12.20.1-1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4380 is a medium vulnerability (CVSS 6.3) in Redhat Ansible Automation Platform, published October 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. No source names a fixed version.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open