Vulnerability record/PUBLISHED/Published Nov 11, 2024 23:32:55 UTC

CVE-2024-11079

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

Base score5.5/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityHighAC

Privileges requiredLowPR

User interactionRequiredUI

ScopeChangedS

Confidentiality impactLowC

Integrity impactLowI

Availability impactLowA

CVSS vector stringCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityredhat

Last updatedNov 5, 2026 11:40:49 UTC

PublishedNov 11, 2024 23:32:55 UTC

ReservedNov 11, 2024 11:57:21 UTC