Every CVE Search/ Get API key

CVE-2024-10033

Aap-gateway: xss on aap-gateway

6.1 Medium

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.40%Up 0.3 points since Oct 17, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.1

Aap-gateway: xss on aap-gateway

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Record
CVE-2024-10033
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-05
EUVDEUVD-2024-33571 6.1

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Record
EUVD-2024-33571
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-h596-hg59-cxrq 5.4

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in...

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Record
GHSA-h596-hg59-cxrq
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 6.1

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Record
CVE-2024-10033
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-05
OSV 6.1

Aap-gateway: xss on aap-gateway

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Record
CVE-2024-10033
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-07
OSVRHSA-2024:8534 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update

Record
RHSA-2024:8534
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 4 CVEs
 before 0:2.5.3-1.el8ap
0:2.5.3-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 4 CVEs
 before 0:2.5.3-1.el9ap
0:2.5.3-1.el9ap
receptor
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptor
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el8ap
0:1.4.9-2.el8ap
Show 10 moreShow less
Affected packages
PackageAffectedFixed
receptor
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptor
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptorctl
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptor
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptor-debuginfo
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptor-debugsource
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
receptorctl
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 4 CVEs
 before 0:1.4.9-2.el9ap
0:1.4.9-2.el9ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 4 CVEs
 before 0:4.6.2-1.el8ap
0:4.6.2-1.el8ap
automation-controller-venv-tower
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 4 CVEs
 before 0:4.6.2-1.el9ap
0:4.6.2-1.el9ap

History

History
RecordedChangedSources
affected, factsCVE List, NVD, OSV
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10033 is a medium vulnerability (CVSS 6.1) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published October 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 33rd percentile. No source names a fixed version.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open