CVE-2025-53862

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—
Red Hat	Red Hat Ansible Automation Platform 2	—

References

https://access.redhat.com/security/cve/CVE-2025-53862Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2379359Issue Tracking

Timeline

Published: Jul 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-538645.8Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deepl CVE-2025-538656.4In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).CVE-2025-538679.8Island Lake WebBatch before 2025C allows Remote Code Execution via a crafted URL.CVE-2025-538688.7When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode CVE-2025-538693.7Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attac CVE-2025-53879.8A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateCon CVE-2025-538706.7An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 throug CVE-2025-53889.8A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the CVE-2025-538808.7A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or d CVE-2025-538816.9A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/g CVE-2025-538824.4A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the CVE-2025-538839.3A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript v