Technical information disclosure

[umesawan]

The applications Ansible disclose the versions of Ansible AWX (24.6.0), respectively, to unauthenticated users. This practice poses a security risk, as it allows attackers to easily identify the software versions in use and search for associated known vulnerabilities, which they could exploit to compromise the applications.

Information disclosure, also known as information leak, occurs when a website reveals sensitive
information. Depending on the context, websites can disclose all kinds of information to a potential
attacker, including:
Data concerning other users, such as usernames or financial information.
Sensitive commercial or professional data.
Technical details about the website and its infrastructure.
The dangers of leaking sensitive user or corporate data are obvious enough, but the disclosure of
technical information can sometimes be equally severe. While some of this information may be of limited
use, it can potentially provide a starting point for exposing an additional attack surface, which may
contain other interesting vulnerabilities.

ISSUE TYPE

Bug, Docs Fix or other nominal change

COMPONENT NAME

• API

SUMMARY

ENVIRONMENT

• AWX version: 24.6.0
• AWX install method: operator, developer environment
• AWX deployment target: kubernetes
• Operating System: Ubuntu Linux
• Web Browser: any

STEPS TO REPRODUCE

EXPECTED RESULTS

To enhance the security of the applications, it is crucial to conceal technical information, such as software
versions, especially from unauthenticated users. Implementing this measure may require modifications
to the source code sections that expose software version details.

ACTUAL RESULTS

ADDITIONAL INFORMATION