CVE-2024-8775

Aliases:GHSA-jpxc-vmjf-9fcj
Advisory lineage Upstream: 0 Downstream: 13
Deferred
Published: 14 Sept 2024, 02:15
Last modified:06 Nov 2025, 23:17

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.04% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Sept 2024, 02:15
Published
Vulnerability first disclosed
06 Nov 2025, 23:17
Last Modified
Vulnerability information updated

Description

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

CVSS Metrics

  • v4.0•HIGH•Score: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.04%• Percentile: 11%

Techniques & Countermeasures

  • CWE-532•Insertion of Sensitive Information into Log File

    The product writes sensitive information to a log file.

Affected Systems

  • PyPI•ansible-core

    ≥ 2.17.0b1, < 2.17.6 | < 2.16.13

References (13)