{"id":9412,"date":"2025-07-31T09:41:56","date_gmt":"2025-07-31T09:41:56","guid":{"rendered":"http:\/\/localhost\/?p=9412"},"modified":"2025-07-31T09:41:56","modified_gmt":"2025-07-31T09:41:56","slug":"python311-django-ansible-base-sensitive-authenticator-secrets-returned-in-clear-text-via-api-in-aap","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=9412","title":{"rendered":"Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap"},"content":{"rendered":"
\n

CVE Details<\/h2>\n
\n
\n

Basic Information<\/h3>\n\n\n\n\n\n
Title<\/th>\nPython3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap<\/td>\n<\/tr>\n
Type<\/th>\ncve<\/td>\n<\/tr>\n
Published<\/th>\n2025-07-31T14:12:02.648Z<\/td>\n<\/tr>\n
Modified<\/th>\n2025-07-31T14:21:26.556Z<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Product Information<\/h3>\n\n\n\n
Vendor<\/th>\nRed Hat<\/td>\n<\/tr>\n
Product<\/th>\nRed Hat Ansible Automation Platform 2<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
\n

CVSS Information<\/h3>\n\n\n\n
Base Score<\/th>\n4.4 (MEDIUM)<\/td>\n<\/tr>\n
Attack Vector<\/th>\nCVSS:3.1\/AV:N\/AC:H\/PR:H\/UI:N\/S:U\/C:H\/I:N\/A:N<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

AI Analysis<\/h3>\n\n\n\n\n\n
AI Description<\/th>\nA vulnerability in Ansible Automation Platform exposes client secrets for GitHub Enterprise authenticators via the Gateway API in clear text, risking accidental leaks or misuse among privileged users.<\/td>\n<\/tr>\n
AI Severity<\/th>\nMedium<\/td>\n<\/tr>\n
AI Vendor<\/th>\nRed Hat<\/td>\n<\/tr>\n
AI Product<\/th>\nAnsible Automation Platform<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Additional Information<\/h3>\n\n\n\n
CWE List<\/th>\nCWE-312<\/td>\n<\/tr>\n
Source<\/th>\nredhat<\/td>\n<\/tr>\n<\/table>\n<\/div>\n
\n

Description<\/h3>\n
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.<\/div>\n<\/div>\n
\n

References<\/h4>\n