CVE-2024-8775

MediumCVSS 5.5/10Last modified Sep 17, 2026

Description

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Sep 14, 2024
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-87766.1SmartRobot from INTUMIT does not properly validate a specific page parameter, allowing unautheticated remote attackers to inject JavaScript CVE-2024-87777.5OMFLOW from The SYSCOM Group has an information leakage vulnerability, allowing unauthorized remote attackers to read arbitrary system confiCVE-2024-87786.5OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular priCVE-2024-87798.8OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers CVE-2024-87806.5OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with reguCVE-2024-87818.7Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) alloCVE-2024-87829.8A vulnerability was found in JFinalCMS up to 1.0. It has been rated as critical. This issue affects the function delete of the file /admin/tCVE-2024-87835.4A vulnerability classified as problematic has been found in OpenTibiaBR MyAAC up to 0.8.16. Affected is an unknown function of the file systCVE-2024-87848.8A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknownCVE-2024-87855.3In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existinCVE-2024-87866.1The Auto Featured Image from Title plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg withCVE-2024-87876.1The Smart Online Order for Clover plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & rem
CVE-2024-8775: Medium severity, CVSS 5.5 | Vulnix