Search for vulnerabilities
Vulnerability details: VCID-xdpn-ahfy-p3ft
Vulnerability ID VCID-xdpn-ahfy-p3ft
Aliases CVE-2024-9902
GHSA-32p4-gm2c-wmch
Summary ansible-core Incorrect Authorization vulnerability A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-863 Incorrect Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.3 https://access.redhat.com/errata/RHSA-2024:10762
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:10762
ssvc Track https://access.redhat.com/errata/RHSA-2024:10762
cvssv3.1 6.3 https://access.redhat.com/errata/RHSA-2024:8969
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:8969
ssvc Track https://access.redhat.com/errata/RHSA-2024:8969
cvssv3.1 6.3 https://access.redhat.com/errata/RHSA-2024:9894
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:9894
ssvc Track https://access.redhat.com/errata/RHSA-2024:9894
cvssv3.1 6.3 https://access.redhat.com/errata/RHSA-2025:1861
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2025:1861
ssvc Track https://access.redhat.com/errata/RHSA-2025:1861
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9902.json
cvssv3.1 6.3 https://access.redhat.com/security/cve/CVE-2024-9902
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2024-9902
ssvc Track https://access.redhat.com/security/cve/CVE-2024-9902
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2024-9902
cvssv3.1 6.3 https://bugzilla.redhat.com/show_bug.cgi?id=2318271
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2318271
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2318271
cvssv3.1 6.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-32p4-gm2c-wmch
cvssv3.1 6.3 https://github.com/ansible/ansible
generic_textual MODERATE https://github.com/ansible/ansible
cvssv3.1 6.3 https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be
generic_textual MODERATE https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be
cvssv3.1 6.3 https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65
generic_textual MODERATE https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65
cvssv3.1 6.3 https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892
generic_textual MODERATE https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892
cvssv3.1 6.3 https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd
generic_textual MODERATE https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd
cvssv3.1 6.3 https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92
generic_textual MODERATE https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92
cvssv3.1 6.3 https://nvd.nist.gov/vuln/detail/CVE-2024-9902
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-9902
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:10762
https://access.redhat.com/errata/RHSA-2024:8969
https://access.redhat.com/errata/RHSA-2024:9894
https://access.redhat.com/errata/RHSA-2025:1861
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9902.json
https://access.redhat.com/security/cve/CVE-2024-9902
https://api.first.org/data/v1/epss?cve=CVE-2024-9902
https://bugzilla.redhat.com/show_bug.cgi?id=2318271
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9902
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/ansible/ansible
https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be
https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65
https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892
https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd
https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92
https://nvd.nist.gov/vuln/detail/CVE-2024-9902
1086883 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1086883
cpe:/a:redhat:ansible_automation_platform:2.4::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:2.4::el9
cpe:/a:redhat:ansible_automation_platform:2.5::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8
cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9
cpe:/a:redhat:ansible_automation_platform:ee::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:ee::el8
cpe:/a:redhat:ansible_automation_platform:ee::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:ee::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_inside:2.4::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_inside:2.4::el9
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8
cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
cpe:/a:redhat:ansible_core:2::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_core:2::el8
cpe:/a:redhat:ansible_core:2::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_core:2::el9
cpe:/a:redhat:openstack:17.1::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openstack:17.1::el9
cpe:/o:redhat:enterprise_linux:10 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10
GHSA-32p4-gm2c-wmch https://github.com/advisories/GHSA-32p4-gm2c-wmch
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://access.redhat.com/errata/RHSA-2024:10762
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-06T14:20:56Z/ Found at https://access.redhat.com/errata/RHSA-2024:10762
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://access.redhat.com/errata/RHSA-2024:8969
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-06T14:20:56Z/ Found at https://access.redhat.com/errata/RHSA-2024:8969
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://access.redhat.com/errata/RHSA-2024:9894
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-06T14:20:56Z/ Found at https://access.redhat.com/errata/RHSA-2024:9894
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://access.redhat.com/errata/RHSA-2025:1861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-06T14:20:56Z/ Found at https://access.redhat.com/errata/RHSA-2025:1861
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-9902.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://access.redhat.com/security/cve/CVE-2024-9902
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-06T14:20:56Z/ Found at https://access.redhat.com/security/cve/CVE-2024-9902
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=2318271
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-11-06T14:20:56Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2318271
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/ansible/ansible
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-9902
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.12117
EPSS Score 0.00043
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:33:48.575413+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-32p4-gm2c-wmch/GHSA-32p4-gm2c-wmch.json 37.0.0