CVE-2024-71436.7MediumCWE-277

CVE-2024-7143: Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

Red Hat · Red Hat Ansible Automation Platform 2

Vendor fix available · Affected: Red Hat Ansible Automation Platform 2 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.6%probability of exploitation in the next 30 days

49th percentile

050100

Higher than 49% of scored CVEs

6.7MediumCVSS 3.0

LowMediumHighCrit.

DescriptionCVE.org

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.

Affected products5

From the CVE record. A product or version that is not listed is unknown, not unaffected.

pulpup to and including 3.56.0
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Ansible Automation Platform 2Versions not stated
Red Hat · Red Hat Satellite 6Versions not stated
Red Hat · Red Hat Update Infrastructure 4 for Cloud ProvidersVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Insecure Inherited Permissions · Access Control
Vendor: Red Hat
Published: August 2024
Band: Unlikely (under 1%), August 2024

CoverageNo articles yet

No CyberSIXT article names CVE-2024-7143 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.