CVE-2023-3971

MEDIUM 5.4CVE-2023-3971 · Published 04/10/2023 · updated 17/06/2026

In short

CVE-2023-3971 is a MEDIUM (CVSS 5.4) vulnerability affecting ansible automation controller (redhat), ansible automation platform (redhat), ansible developer (redhat).
Chance of exploitation in the next 30 days (EPSS): 0.82%, higher than 57.1% of all vulnerabilities.
Fix: update to 4.3.11 or later.

Package	Affected versions	Patched versions
ansible automation controller redhat	`= 4.4< 4.3.11`	`4.3.11`
ansible automation platform redhat	`= 2.3= 2.4`	No fix yet
ansible developer redhat	`= 1.0`	No fix yet
ansible inside redhat	`= 1.1`	No fix yet

Description

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

References

access.redhat.com/errata/RHSA-2023:4340 · Vendor Advisory
access.redhat.com/errata/RHSA-2023:4590 · Vendor Advisory
access.redhat.com/security/cve/CVE-2023-3971 · Vendor Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free