CVE-2024-36110 - Vulnerability Details - OpenCVE

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00249.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

References

Link	Providers
https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522
https://github.com/ansibleguy/webui/files/15358522/Report.pdf
https://github.com/ansibleguy/webui/issues/44
https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00181}`	epss `{'score': 0.00184}`

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.001}`	epss `{'score': 0.00181}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-05-28T18:33:56.721Z

Updated: 2024-08-02T03:30:12.971Z

Reserved: 2024-05-20T21:07:48.186Z

Link: CVE-2024-36110

Vulnrichment

Updated: 2024-08-02T03:30:12.971Z

NVD

Status : Deferred

Published: 2024-05-28T19:15:11.110

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-36110

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36110", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-20T21:07:48.186Z", "datePublished": "2024-05-28T18:33:56.721Z", "dateUpdated": "2024-08-02T03:30:12.971Z"}, "containers": {"cna": {"title": "Cross-site scripting in ansibleguy-webui", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj"}, {"name": "https://github.com/ansibleguy/webui/issues/44", "tags": ["x_refsource_MISC"], "url": "https://github.com/ansibleguy/webui/issues/44"}, {"name": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522", "tags": ["x_refsource_MISC"], "url": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522"}, {"name": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf", "tags": ["x_refsource_MISC"], "url": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf"}], "affected": [{"vendor": "ansibleguy", "product": "webui", "versions": [{"version": "< 0.0.21", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-28T18:33:56.721Z"}, "descriptions": [{"lang": "en", "value": "ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues."}], "source": {"advisory": "GHSA-927p-xrc2-x2gj", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-28T20:13:21.843733Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ansibleguy:webui:*:*:*:*:*:*:*:*"], "vendor": "ansibleguy", "product": "webui", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.21", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:37.934Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.971Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj"}, {"name": "https://github.com/ansibleguy/webui/issues/44", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ansibleguy/webui/issues/44"}, {"name": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522"}, {"name": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj", "name": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/ansibleguy/webui/issues/44", "name": "https://github.com/ansibleguy/webui/issues/44", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522", "name": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf", "name": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:30:12.971Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36110", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-28T20:13:21.843733Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ansibleguy:webui:*:*:*:*:*:*:*:*"], "vendor": "ansibleguy", "product": "webui", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.21", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T20:11:27.692Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Cross-site scripting in ansibleguy-webui", "source": {"advisory": "GHSA-927p-xrc2-x2gj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ansibleguy", "product": "webui", "versions": [{"status": "affected", "version": "< 0.0.21"}]}], "references": [{"url": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj", "name": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ansibleguy/webui/issues/44", "name": "https://github.com/ansibleguy/webui/issues/44", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522", "name": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf", "name": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-28T18:33:56.721Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36110", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:30:12.971Z", "dateReserved": "2024-05-20T21:07:48.186Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-28T18:33:56.721Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 (0.0.21.post2 on pypi). Users are advised to upgrade. There are no known workarounds for these issues."}, {"lang": "es", "value": "ansibleguy-webui es una WebUI de c\u00f3digo abierto para usar Ansible. M\u00faltiples formularios en versiones <0.0.21 permit\u00edan la inyecci\u00f3n de elementos HTML. Estos se devuelven al usuario despu\u00e9s de ejecutar acciones de trabajo y, por lo tanto, el navegador los eval\u00faa. Estos problemas se solucionaron en la versi\u00f3n 0.0.21 (0.0.21.post2 en pypi). Se recomienda a los usuarios que actualicen. No se conocen workarounds para estos problemas."}], "id": "CVE-2024-36110", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-05-28T19:15:11.110", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522"}, {"source": "security-advisories@github.com", "url": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf"}, {"source": "security-advisories@github.com", "url": "https://github.com/ansibleguy/webui/issues/44"}, {"source": "security-advisories@github.com", "url": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/ansibleguy/webui/commit/7737b47e7f7ddbfec7b1418c724598363718d522"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/ansibleguy/webui/files/15358522/Report.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/ansibleguy/webui/issues/44"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/ansibleguy/webui/security/advisories/GHSA-927p-xrc2-x2gj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}