Description
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's location.href without verifying its format or scheme. The platform includes built-in URL validation functions designed to block malicious URI schemes (such as javascript: and data:) as well as off-site or protocol-relative redirects, this specific route bypasses those controls. Consequently, an attacker can craft a malicious link that, when accessed by an authenticated user, causes arbitrary JavaScript to execute within the context of the user's session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Hardened Images
Default version status: unaffected