LiveActive security incident?Get immediate response
CVE Record

CVE-2020-14327: A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3....

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-14327 is an SSRF flaw in Ansible Tower before 3.6.5 and before 3.7.2. A user could abuse Tower’s credential lookup test feature to make the Tower server send HTTP or HTTPS requests and return responses, potentially exposing internal services reachable from that server.

Executive priority

Prioritize remediation if Ansible Tower manages sensitive infrastructure or can reach internal management services. The issue is not reported as actively exploited in the provided sources, but SSRF from an automation server can create meaningful internal exposure.

Technical view

The CVE describes CWE-918 server-side request forgery in Ansible Tower. The vulnerable behavior involves supplying a URL to Tower functionality, specifically the lookup credential test feature, causing server-originated HTTP/HTTPS requests and retrieval of response results from internal or otherwise reachable services.

Likely exposure

Exposure is likely limited to organizations running Ansible Tower versions earlier than 3.6.5 or earlier than 3.7.2, especially where users can access credential lookup testing. Internal service reachability from the Tower host affects impact.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The abuse path is described at a functional level, but no exploit availability, authentication requirement, or CVSS score is provided in the source bundle.

Researcher notes

Source evidence is concise and lacks CVSS, exploit status, and detailed prerequisites. Focus research on affected Tower branch/version confirmation, privilege needed to reach the lookup credential test feature, and what internal services the Tower host can access.

Mitigation direction

  • Upgrade Ansible Tower 3.6.x to 3.6.5 or later.
  • Upgrade Ansible Tower 3.7.x to 3.7.2 or later.
  • Restrict credential lookup test access to trusted administrators.
  • Limit Tower server egress to approved internal and external destinations.
  • Review Red Hat guidance for any environment-specific mitigations.

Validation and detection

  • Inventory all Ansible Tower instances and record exact versions.
  • Confirm no Tower instance is older than 3.6.5 or 3.7.2.
  • Review who can use lookup credential test functionality.
  • Check Tower logs for unusual credential test URLs or internal service targets.
  • Validate egress controls from the Tower server network segment.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-918: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Cloud metadata behavior lookup

The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-14327 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aToweransible_tower 3.6.5, ansible_tower 3.7.2Listed
Weakness

CWE details

CWE-918

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-918 · source CWE mapping

Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs