Skip to main content

Improper Handling of Parameters

CVE-2022-3697

High
7.5/10

Summary

A flaw was found in Ansible 2.5.0b1 through 6.7.0 in the amazon.aws collection when using the "tower_callback" parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-233 - Improper Handling of Parameters

The software does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

References

Advisory Timeline

  • Published