CVE-2018-10884

Name of the Vulnerable Software and Affected Versions Ansible Tower versions prior to 3.1.8 and 3.2.6

Description The issue allows for cross-site request forgery (CSRF) in the awx/api/authentication.py module. An attacker could exploit this by tricking already authenticated users into visiting a malicious site, thereby hijacking the authtoken cookie.

Recommendations For versions prior to 3.1.8, update to version 3.1.8 or later. For versions prior to 3.2.6, update to version 3.2.6 or later.