{"id":"CVE-2024-10033","aliases":["EUVD-2024-33571","GHSA-h596-hg59-cxrq","RHSA-2024:8534"],"status":"published","title":"Aap-gateway: xss on aap-gateway","description":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00395,"percentile":0.33979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2024-10-16T16:59:43Z","modified":"2026-11-05T21:15:31Z","affected":[{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.3-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.9-2.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-1.el8ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.2-1.el9ap"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"redhat","product":"ansible_automation_platform"},{"vendor":"redhat","product":"ansible_developer"},{"vendor":"redhat","product":"ansible_inside"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:8534","tags":["vendor-advisory","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-10033","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2319162","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10033","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h596-hg59-cxrq"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10033.json","tags":["advisory"]},{"url":"https://github.com/ansible/ansible","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2273513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2302433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2314485","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8534.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10033","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22189","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22189","tags":["advisory"]},{"url":"https://github.com/quic-go/quic-go/commit/4a99b816ae3ab03ae5449d15aac45147c85ed47a","tags":["article"]},{"url":"https://github.com/quic-go/quic-go/security/advisories/GHSA-c33x-xqrf-c478","tags":["article"]},{"url":"https://seemann.io/posts/2024-03-19-exploiting-quics-connection-id-management","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-41989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41989","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45230","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45230","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-10033","title":"Aap-gateway: xss on aap-gateway","description":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.","status":"published","published":"2024-10-16T16:59:43.968Z","modified":"2026-11-05T11:40:16.669Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2024-33571","description":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.","status":"published","published":"2024-10-16T16:59:43Z","modified":"2026-11-05T11:40:16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-h596-hg59-cxrq","title":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in...","description":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.","status":"published","published":"2024-10-16T18:31:45Z","modified":"2024-10-30T03:30:29Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:58:39.26425Z"}],"nvd":[{"id":"CVE-2024-10033","description":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.","status":"published","published":"2024-10-16T17:15:13.267Z","modified":"2026-11-05T12:17:43.587Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-05T16:36:40.983114Z"}],"osv":[{"id":"CVE-2024-10033","title":"Aap-gateway: xss on aap-gateway","description":"A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.","status":"published","published":"2024-10-16T16:59:43.968Z","modified":"2026-11-07T02:30:30.722892677Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:07:52.010191Z"},{"id":"RHSA-2024:8534","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Release Update","status":"published","published":"2024-10-30T09:31:18Z","modified":"2026-10-14T10:05:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"}]}}