{"api_version":"1","generated_at":"2026-07-23T08:05:56+00:00","cve":"CVE-2018-1101","urls":{"html":"https://cve.report/CVE-2018-1101","api":"https://cve.report/api/cve/CVE-2018-1101.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1101","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1101"},"summary":{"title":"CVE-2018-1101","description":"Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2018-05-02 18:29:00","updated_at":"2019-10-09 23:38:00"},"problem_types":["CWE-521"],"metrics":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1328","name":"RHSA-2018:1328","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.ansible.com/security","name":"https://www.ansible.com/security","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"Ansible Security Disclosures","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2018:1972","name":"RHSA-2018:1972","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/security/cve/cve-2018-1101","name":"https://access.redhat.com/security/cve/cve-2018-1101","refsource":"MISC","tags":["Third Party Advisory"],"title":"CVE-2018-1101 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563492","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1563492","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"],"title":"1563492 – (CVE-2018-1101) CVE-2018-1101 ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1101","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1101","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1101","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"ansible_tower","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1101","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"ansible_tower","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1101","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms","cpe6":"4.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1101","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms","cpe6":"4.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1101","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms","cpe6":"4.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"1101","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms","cpe6":"4.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","DATE_PUBLIC":"2018-04-27T00:00:00","ID":"CVE-2018-1101","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Ansible Tower","version":{"version_data":[{"version_value":"before 3.2.4"}]}}]},"vendor_name":"Red Hat, Inc."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-266"}]}]},"references":{"reference_data":[{"name":"https://www.ansible.com/security","refsource":"CONFIRM","url":"https://www.ansible.com/security"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=1563492","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563492"},{"name":"RHSA-2018:1972","refsource":"REDHAT","url":"https://access.redhat.com/errata/RHSA-2018:1972"},{"name":"https://access.redhat.com/security/cve/cve-2018-1101","refsource":"MISC","url":"https://access.redhat.com/security/cve/cve-2018-1101"},{"name":"RHSA-2018:1328","refsource":"REDHAT","url":"https://access.redhat.com/errata/RHSA-2018:1328"}]}},"nvd":{"publishedDate":"2018-05-02 18:29:00","lastModifiedDate":"2019-10-09 23:38:00","problem_types":["CWE-521"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.4","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1101","Ordinal":"116332","Title":"CVE-2018-1101","CVE":"CVE-2018-1101","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1101","Ordinal":"1","NoteData":"Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1101","Ordinal":"2","NoteData":"2018-05-02","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"1101","Ordinal":"3","NoteData":"2018-07-09","Type":"Other","Title":"Modified"}]}}}