What is the CVSS score of CVE-2023-5764?

CVE-2023-5764 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2023-5764?

Yes, a patch is available for CVE-2023-5764. Update the affected software to the latest version immediately.

Ansible CVE-2023-5764

HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2023-12-12 secalert@redhat.com

Code Injection Red Hat Ssti Fedora Ansible Automation Platform Ansible Extra Packages For Enterprise Linux Ansible Developer Ansible Inside Fedoraproject

7.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-1336 ASVS 5.0 V1 - Encoding and Sanitization Template injection prevention
Impact	CVSS score of 7.8 (HIGH). Attack characteristics: local attack vector, low complexity, low privileges required, no user interaction not required.
Exploit ScenarioDerived	Successful exploitation could compromise the high-severity affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

pypi ansible-core fix: 2.14.12, 2.15.8, 2.16.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified under CWE-1336. A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data. Affected products include: Redhat Ansible, Fedoraproject Extra Packages For Enterprise Linux, Fedoraproject Fedora, Redhat Ansible Automation Platform, Redhat Ansible Developer.

Know when Ansible gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Affected Products (CPE)NVD

cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible:2.16.0:-:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible:2.16.0:beta1:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible:2.16.0:beta2:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible:2.16.0:rc1:*:*:*:*:*:*

cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible_automation_platform:2.4:*:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible_developer:1.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:ansible_inside:1.2:*:*:*:*:*:*:*

More in Ansible

View all

CVE-2015-1482 MEDIUM This Month POC

5.0 Feb 04

Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive inform

CVE-2015-1481 MEDIUM This Month POC

6.5 Feb 04

Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a s

CVE-2015-1368 MEDIUM This Month POC

4.3 Jan 27

Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attacker

CVE-2019-10217 MEDIUM This Month POC

6.5 Nov 25

A flaw was found in ansible 2.8.0 before 2.8.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploit

CVE-2017-7550 CRITICAL Act Now

9.8 Nov 21

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkin

CVE-2021-33924 CRITICAL Act Now

9.8 Sep 29

Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its a

CVE-2020-1733 MEDIUM This Month POC

5.0 Mar 11

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a play

CVE-2014-3498 HIGH This Week

8.8 Jun 08

The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. Rated high seve

CVE-2026-89091 HIGH This Week

8.8 Oct 08

Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax

CVE-2020-1735 MEDIUM This Month POC

4.6 Mar 16

A flaw was found in the Ansible Engine when the fetch module is used. Rated medium severity (CVSS 4.6), this vulnerabili

CVE-2026-87874 HIGH This Week

8.1 Sep 09

Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached f

CVE-2015-6240 HIGH This Week

7.8 Jun 07

The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environme

Same weakness CWE-1336 – Improper Neutralization of Special Elements Used in a Template Engine

View all

CVE-2024-23692 CRITICAL POC

9.8

CVE-2025-47916 CRITICAL POC

10.0

CVE-2025-49619 HIGH POC

8.5

CVE-2024-6386 CRITICAL POC

9.9

CVE-2026-75650 CRITICAL POC

10.0

CVE-2025-69516 HIGH POC

8.8

CVE-2025-49136 CRITICAL POC

9.0

CVE-2025-53833 CRITICAL POC

10.0

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

References

Advisories & patches

PATCH https://bugzilla.redhat.com/show_bug.cgi?id=2247629 ADVISORY https://access.redhat.com/errata/RHSA-2023:7773 ADVISORY https://access.redhat.com/security/cve/CVE-2023-5764 REF https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/ REF https://security.netapp.com/advisory/ntap-20241025-0001/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back