QID 14011

Ansible Tower by Red Hat helps you scale IT automation, manage complex deployments and speed productivity.

CVE-2020-11022: jQuery passing HTML from untrusted sources
CVE-2020-11023: jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources.
CVE-2020-35678: Autobahn|Python before 20.12.3 allows redirect header injection.
CVE-2021-3281: Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 allows directory traversal via an archive with absolute paths or relative paths with dot segments.
CVE-2021-20253: A flaw was found in ansible-tower elevate the privilege from a low privileged user to the awx user from outside the isolated environment.

Affected Versions:
Ansible Tower 3.6.0 to 3.6.6
Ansible Tower 3.7.0 to 3.7.4
Ansible Tower 3.8.0 to 3.8.1

QID Detection Logic:(Unauthenticated)
This QID checks the vulnerable Ansible Tower version installed on the target by checking the response of /api/v1/ping/?format=json.

An attacker could exploit this to read unauthorized web pages, elevate the privilege from a low privileged user to the awx user from outside the isolated environment, allows directory traversal and execute untrusted code.