Home

Description

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

PUBLISHED Reserved 2025-06-11 | Published 2025-08-04 | Updated 2025-11-07 | Assigner redhat




MEDIUM: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

Any version before 2.5.20250730
affected

Default status
affected

0:2.5.20250730-2.el8ap (rpm) before *
unaffected

Default status
affected

0:2.5.20250730-2.el9ap (rpm) before *
unaffected

Timeline

2025-06-11:Reported to Red Hat.
2025-08-04:Made public.

Credits

This issue was discovered by Brennan Paciorek (Red Hat Inc.), Chris Meyers (Red Hat Inc.), Hao Liu (Red Hat Inc.), and Julen Landa Alustiza (Red Hat Inc.).

References

access.redhat.com/errata/RHSA-2025:12772 (RHSA-2025:12772) vendor-advisory

access.redhat.com/security/cve/CVE-2025-5988 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2371644 (RHBZ#2371644) issue-tracking

cve.org (CVE-2025-5988)

nvd.nist.gov (CVE-2025-5988)

Download JSON