CVE-2021-20180

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

VendorProductVersions
n/aAnsibleFixed in ansible 2.9.18

References

Timeline

Published
Mar 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-201817.5A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client CVE-2021-201828.8A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted envirCVE-2021-201835.4It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of searchCVE-2021-201844.3It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meantCVE-2021-201855.3It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages,CVE-2021-201865.4It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of CVE-2021-201877.2It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP CVE-2021-201887.0A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. ThCVE-2021-20192.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected arCVE-2021-201908.1A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The higCVE-2021-201915.5A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log featureCVE-2021-201933.3A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause