CVE-2023-5764

HighCVSS 7.8/10Last modified Nov 5, 2026

Description

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 9	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 9	—
Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 9	—
Red Hat	Red Hat Ansible Automation Platform 1.2	—

References

https://access.redhat.com/errata/RHSA-2023:7773Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-5764Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2247629Issue Tracking, Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:7773Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-5764Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2247629Issue Tracking, Patch, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/
https://security.netapp.com/advisory/ntap-20241025-0001/

Timeline

Published: Dec 12, 2023
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-57659.8Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an at CVE-2023-57669.8A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code CVE-2023-57676.1A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cros CVE-2023-57686.1A vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Incomplete or wrong receive CVE-2023-57696.1A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. A malicious actor could perform cros CVE-2023-57705.4Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject impr CVE-2023-57716.1Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafte CVE-2023-57724.3The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is CVE-2023-57745.4The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to,CVE-2023-57752.7The BackWPup plugin for WordPress is vulnerable to Plaintext Storage of Backup Destination Password in all versions up to, and including, 4.CVE-2023-57768.8The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. Thi CVE-2023-57779.8Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission