CVE-2025-53861

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

A flaw was found in Ansible. Sensitive cookies without security flags over non-encrypted channels can lead to Man-in-the-Middle (MitM) and Cross-site scripting (XSS) attacks allowing attackers to read transmitted data.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2—

References

Timeline

Published
Jul 11, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-538623.5A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious CVE-2025-538645.8Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeplCVE-2025-538656.4In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).CVE-2025-538679.8Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.CVE-2025-538688.7When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode CVE-2025-538693.7Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacCVE-2025-53879.8A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateConCVE-2025-538706.7An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 througCVE-2025-53889.8A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the CVE-2025-538808.7A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or dCVE-2025-538816.9A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/gCVE-2025-538824.4A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the