6.5 CVE-2025-2877

 

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.
https://nvd.nist.gov/vuln/detail/CVE-2025-2877

Categories

CWE-1295 : Debug Messages Revealing Unnecessary Information
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages. Ensure that a debug message does not reveal any unnecessary information during the debug process for the intended response. Digital Rights Management (DRM) capability for mobile platform leaks pointer information, simplifying ASLR bypass Processor generates debug message that contains sensitive information ("addresses of memory transactions"). modem debug messages include cryptographic keys

References


 

CPE

cpe start end

REMEDIATION


EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
121 Exploit Non-Production Interfaces
High