Skip to content
Fencer Vulns
high 8.4

CVE-2017-12148 json

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories.

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3732

cvss
8.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as.

Patch / fix

  • redhat ansible_tower 3.1.5, 3.2.0
  • cfme cloudforms managementengine 5.8 5.8.2.3-1.el7cf
  • supervisor cloudforms managementengine 5.8 3.1.4-1.el7
  • cfme-gemset cloudforms managementengine 5.8 5.8.2.3-1.el7cf
  • cfme-appliance cloudforms managementengine 5.8 5.8.2.3-1.el7cf
  • rabbitmq-server cloudforms managementengine 5.8 3.6.9-1.el7at
  • ansible-tower-setup cloudforms managementengine 5.8 3.1.5-1.el7at
  • ansible-tower-server cloudforms managementengine 5.8 3.1.5-1.el7at
  • rh-ruby23-rubygem-nokogiri cloudforms managementengine 5.8 1.8.1-2.el7cf

red hat advisories RHSA-2017:3005

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-12148 updated cvss 8.4

Tower: modification of git hooks in SCM repo via upstream playbook execution

  • Red Hat Ansible Tower 3 security
    affected: no fix available
  • Red Hat CloudForms Management Engine 5.8 cfme 5.8.2.3-1.el7cf, supervisor 3.1.4-1.el7, cfme-gemset 5.8.2.3-1.el7cf, rabbitmq-server 3.6.9-1.el7at, cfme-appliance 5.8.2.3-1.el7cf, ansible-tower-setup 3.1.5-1.el7at, +2 more
    fixed: vendor fix RHSA-2017:3005

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.71% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
NVD 3.0 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

  • Red Hat Ansible Tower

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.