Every CVE Search/ Get API key

CVE-2024-11483

Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

5.0 Medium

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.52%Up 0.5 points since Nov 25, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.0

Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Record
CVE-2024-11483
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2024-34309 5.0

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Record
EUVD-2024-34309
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-q73v-w388-wp95 5.0

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to...

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Record
GHSA-q73v-w388-wp95
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
NVD 5.0

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Record
CVE-2024-11483
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
OSV 5.0

Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.

Record
CVE-2024-11483
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-284
Updated
2026-11-02
OSVRHSA-2024:11145 5.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record
RHSA-2024:11145
CVSS 3.1
5.5 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el8
From an advisory covering 2 CVEs
 before 1:2.16.14-1.el8ap
1:2.16.14-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el8
From an advisory covering 2 CVEs
 before 1:2.16.14-1.el8ap
1:2.16.14-1.el8ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 2 CVEs
 before 1:2.16.14-1.el8ap
1:2.16.14-1.el8ap
ansible-core
Red Hat:ansible_automation_platform_developer:2.5::el9
From an advisory covering 2 CVEs
 before 1:2.16.14-1.el9ap
1:2.16.14-1.el9ap
ansible-core
Red Hat:ansible_automation_platform_inside:2.5::el9
From an advisory covering 2 CVEs
 before 1:2.16.14-1.el9ap
1:2.16.14-1.el9ap
ansible-core
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 2 CVEs
 before 1:2.16.14-1.el9ap
1:2.16.14-1.el9ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el8
From an advisory covering 2 CVEs
 before 0:2.5.20241218-1.el8ap
0:2.5.20241218-1.el8ap
automation-gateway-server
Red Hat:ansible_automation_platform:2.5::el9
From an advisory covering 2 CVEs
 before 0:2.5.20241218-1.el9ap
0:2.5.20241218-1.el9ap

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11483 is a medium vulnerability (CVSS 5.0) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published November 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. No source names a fixed version.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open