CVE-2024-10033
Aap-gateway: xss on aap-gateway
CVE-2024-10033 is a medium vulnerability (CVSS 6.1) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published October 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.
- Severity
- 6.1 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.40%EPSS, 34th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 4 CVEs | before 0:2.5.3-1.el8ap | 0:2.5.3-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 4 CVEs | before 0:2.5.3-1.el9ap | 0:2.5.3-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 4 CVEs | before 0:1.4.9-2.el8ap | 0:1.4.9-2.el8ap |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 4 CVEs | before 0:1.4.9-2.el9ap | 0:1.4.9-2.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 4 CVEs | before 0:4.6.2-1.el8ap | 0:4.6.2-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 4 CVEs | before 0:4.6.2-1.el9ap | 0:4.6.2-1.el9ap |
What each source reports
CVE List Score used
Aap-gateway: xss on aap-gateway
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
- Record
CVE-2024-10033- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-05
EUVDEUVD-2024-33571
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
- Record
EUVD-2024-33571- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-h596-hg59-cxrq
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in...
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
- Record
GHSA-h596-hg59-cxrq- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
- Record
CVE-2024-10033- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-05
OSV
Aap-gateway: xss on aap-gateway
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
- Record
CVE-2024-10033- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-07
OSVRHSA-2024:8534
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update
- Record
RHSA-2024:8534- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | CVE List, NVD, OSV | |
| facts | EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/errata/RHSA-2024:8534
bugzilla.redhat.com/show_bug.cgi?id=2319162
nvd.nist.gov/vuln/detail/CVE-2024-10033
github.com/advisories/GHSA-h596-hg59-cxrq
Show 20 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8534.json
cve.org/CVERecord?id=CVE-2024-10033
seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management