Search for vulnerabilities
Vulnerability details: VCID-hx4y-7eby-aaad
Vulnerability ID VCID-hx4y-7eby-aaad
Aliases CVE-2021-20180
GHSA-fh5v-5f35-2rv2
Summary Insertion of Sensitive Information into Log File A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-532 Insertion of Sensitive Information into Log File
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0663
rhas Moderate https://access.redhat.com/errata/RHSA-2021:0664
rhas Moderate https://access.redhat.com/errata/RHSA-2021:1079
rhas Moderate https://access.redhat.com/errata/RHSA-2021:2180
cvssv3 5.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20180.json
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
epss 0.0011 https://api.first.org/data/v1/epss?cve=CVE-2021-20180
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1915808
cvssv3.1 5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-fh5v-5f35-2rv2
cvssv3.1 5.0 https://github.com/ansible/ansible
generic_textual MODERATE https://github.com/ansible/ansible
cvssv3.1 5.5 https://github.com/ansible/ansible/blob/v2.8.19/changelogs/CHANGELOG-v2.8.rst
generic_textual MODERATE https://github.com/ansible/ansible/blob/v2.8.19/changelogs/CHANGELOG-v2.8.rst
cvssv3.1 5.5 https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst
generic_textual MODERATE https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst
cvssv3.1 5.5 https://github.com/ansible/ansible/pull/73242
generic_textual MODERATE https://github.com/ansible/ansible/pull/73242
cvssv3.1 5.5 https://github.com/ansible/ansible/pull/73243
generic_textual MODERATE https://github.com/ansible/ansible/pull/73243
cvssv3.1 5.5 https://github.com/ansible/ansible/tree/v2.7.18/lib/ansible/modules/source_control
generic_textual MODERATE https://github.com/ansible/ansible/tree/v2.7.18/lib/ansible/modules/source_control
cvssv3.1 5.5 https://github.com/ansible/ansible/tree/v2.8.0a1/lib/ansible/modules/source_control
generic_textual MODERATE https://github.com/ansible/ansible/tree/v2.8.0a1/lib/ansible/modules/source_control
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2021-20180
cvssv3 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20180
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2021-20180
archlinux Medium https://security.archlinux.org/AVG-1437
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20180.json
https://api.first.org/data/v1/epss?cve=CVE-2021-20180
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20180
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ansible/ansible
https://github.com/ansible/ansible/blob/v2.8.19/changelogs/CHANGELOG-v2.8.rst
https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst
https://github.com/ansible/ansible/pull/73242
https://github.com/ansible/ansible/pull/73243
https://github.com/ansible/ansible/tree/v2.7.18/lib/ansible/modules/source_control
https://github.com/ansible/ansible/tree/v2.8.0a1/lib/ansible/modules/source_control
1915808 https://bugzilla.redhat.com/show_bug.cgi?id=1915808
985753 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985753
ASA-202102-9 https://security.archlinux.org/ASA-202102-9
AVG-1437 https://security.archlinux.org/AVG-1437
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
CVE-2021-20180 https://nvd.nist.gov/vuln/detail/CVE-2021-20180
GHSA-fh5v-5f35-2rv2 https://github.com/advisories/GHSA-fh5v-5f35-2rv2
RHSA-2021:0663 https://access.redhat.com/errata/RHSA-2021:0663
RHSA-2021:0664 https://access.redhat.com/errata/RHSA-2021:0664
RHSA-2021:1079 https://access.redhat.com/errata/RHSA-2021:1079
RHSA-2021:2180 https://access.redhat.com/errata/RHSA-2021:2180
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-20180.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/blob/v2.8.19/changelogs/CHANGELOG-v2.8.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/pull/73242
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/pull/73243
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/tree/v2.7.18/lib/ansible/modules/source_control
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/ansible/ansible/tree/v2.8.0a1/lib/ansible/modules/source_control
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20180
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20180
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-20180
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07053
EPSS Score 0.00036
Published At April 2, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.