CVE-2024-1657

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform (affected versions not specified)

Description A flaw in the Ansible automation platform was found, related to an insecure WebSocket connection used during installation from the Ansible rulebook EDA server. This issue could allow an attacker with access to any machine in the CIDR block to download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system. The vulnerability is also related to the lack of origin checking in WebSockets due to incorrect channel restriction, which could allow a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.