CVE-2023-5189

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 9	—
Red Hat	Red Hat Satellite 6.14 for RHEL 8	—
Red Hat	Red Hat Satellite 6.14 for RHEL 8	—
Red Hat	Red Hat Satellite 6.15 for RHEL 8	—
Red Hat	Red Hat Satellite 6.15 for RHEL 8	—

References

https://access.redhat.com/errata/RHSA-2023:7773
https://access.redhat.com/errata/RHSA-2024:1536
https://access.redhat.com/errata/RHSA-2024:2010
https://access.redhat.com/security/cve/CVE-2023-5189Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2234387Exploit, Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7773
https://access.redhat.com/errata/RHSA-2024:1536
https://access.redhat.com/errata/RHSA-2024:2010
https://access.redhat.com/security/cve/CVE-2023-5189Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2234387Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-518907.5An infinite loop issue discovered in Mathtex 1.05 and before allows a remote attackers to consume CPU resources via crafted string in the ap CVE-2023-518929.8An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellCont CVE-2023-51906.1Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 202 CVE-2023-519069.8An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet u CVE-2023-51926.5Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.CVE-2023-519249.8An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute CVE-2023-519259.8An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allo CVE-2023-519267.5YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher com CVE-2023-519279.8YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScri CVE-2023-519289.8An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allo CVE-2023-51932.7Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to r CVE-2023-519317.5An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.