CVE-2021-3620

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in the traceback error message. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
n/a	ansible	Fixed in Ansible Engine v2.9.27

References

https://bugzilla.redhat.com/show_bug.cgi?id=1975767Issue Tracking, Patch, Third Party Advisory
https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixesRelease Notes, Third Party Advisory
https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
https://bugzilla.redhat.com/show_bug.cgi?id=1975767Issue Tracking, Patch, Third Party Advisory
https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELOG-v2.9.rst#security-fixesRelease Notes, Third Party Advisory
https://github.com/ansible/ansible/commit/fe28767970c8ec62aabe493c46b53a5de1e5fac0Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html

Timeline

Published: Mar 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-362005.3Under certain circumstances an unauthenticated user could access the the web API for Metasys ADS/ADX/OAS 10 versions prior to 10.1.6 and 11 CVE-2021-362015.3Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions.CVE-2021-362028.8Server-Side Request Forgery (SSRF) vulnerability in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code CVE-2021-362039.1The affected product may allow an attacker to identify and forge requests to internal systems by way of a specially crafted request.CVE-2021-362047.5Under some circumstances an Insufficiently Protected Credentials vulnerability in Johnson Controls Metasys ADS/ADX/OAS 10 versions prior to CVE-2021-362059.8Under certain circumstances the session token is not cleared on logout.CVE-2021-362066.1All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication CVE-2021-362078.8Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated use CVE-2021-362099.8In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.CVE-2021-36218.8A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands CVE-2021-362126.1app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.CVE-2021-362137.5HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action can