Vulnerability Details : CVE-2021-3533
A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
Products affected by CVE-2021-3533
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_tower:3.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:ansible_automation_platform:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack-rdo:-:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Threat overview for CVE-2021-3533
Top countries where our scanners detected CVE-2021-3533
Top open port discovered on systems with this issue
53
IPs affected by CVE-2021-3533 636,225
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2021-3533!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2021-3533
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-3533
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
1.2
|
LOW | AV:L/AC:H/Au:N/C:P/I:N/A:N |
1.9
|
2.9
|
NIST | |
|
2.5
|
LOW | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
1.0
|
1.4
|
NIST |
CWE ids for CVE-2021-3533
-
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.Assigned by: nvd@nist.gov (Primary)
-
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.Assigned by: secalert@redhat.com (Secondary)
References for CVE-2021-3533
-
https://bugzilla.redhat.com/show_bug.cgi?id=1956477
Issue Tracking;Vendor Advisory
Jump to