CVE-2023-5115

MediumCVSS 6.3/10Last modified Nov 7, 2026

Description

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-36 CWE-22

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2.3 for RHEL 8	—
Red Hat	Red Hat Ansible Automation Platform 2.3 for RHEL 9	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 9	—
Red Hat	Red Hat Ansible Automation Platform 1.2	—

References

https://access.redhat.com/errata/RHSA-2023:5701Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5758Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-5115Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2233810Issue Tracking
https://access.redhat.com/errata/RHSA-2023:5701Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:5758Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-5115Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2233810Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html

Timeline

Published: Dec 18, 2023
Last modified: Nov 7, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-511549.8Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.CVE-2023-511575.4Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and obtain sensitive inform CVE-2023-51165.4The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in CVE-2023-51173.7An issue was discovered in GitLab CE/EE affecting all versions before 17.6.0 in which users were unaware that files uploaded to comments on CVE-2023-51185.4The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input da CVE-2023-51194.8The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could CVE-2023-51204.8The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter CVE-2023-51214.8The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup pa CVE-2023-512109.8SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters CVE-2023-512178.8An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitrary code via crafted c CVE-2023-512199.6A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within CVE-2023-51225.3Grafana is an open-source platform for monitoring and observability. The CSV datasource plugin is a Grafana Labs maintained plugin for Grafa