How severe is CVE-2024-9902?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.3 out of 10.

What type of vulnerability is CVE-2024-9902?

This is classified as CWE-863, which is a common weakness in software security.

CVE-2024-9902 - MEDIUM Severity | CVSS 6.3

Vulnerability Description

A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

Related Vulnerabilities

CVE-2016-9575

MEDIUM

CVSS:6.3(Medium)

Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unp...

CWE-8632016

CVE-2017-6590

MEDIUM

CVSS:6.3(Medium)

An issue was discovered in network-manager-applet (aka network-manager-gnome) in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login sc...

CWE-8632017

CVE-2018-1000152

MEDIUM

CVSS:6.3(Medium)

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapsho...

CWE-8632018

CVE-2019-19984

MEDIUM

CVSS:6.3(Medium)

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.

CWE-8632019

CVE-2020-12875

MEDIUM

CVSS:6.3(Medium)

Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive information or functionality by manipulating spec...

CWE-8632020

CVE-2020-26250

MEDIUM

CVSS:6.3(Medium)

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which sh...

CWE-8632020