CVE-2019-19340

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193415.5A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files incl CVE-2019-193425.3A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contain CVE-2019-193437.5A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due CVE-2019-193446.5There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x ver CVE-2019-193457.8A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the CVE-2019-193467.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before t CVE-2019-193487.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the CVE-2019-193497.8An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in CVE-2019-19359.8A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data CVE-2019-193507.8An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Opens CVE-2019-193517.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the CVE-2019-193527.0An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4.