Read the docs
TI-2024-09312 Aliases CVE-2024-10033GHSA-h596-hg59-cxrq

Aap-gateway: xss on aap-gateway

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed aap-gateway: 2.5.3Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—aap-gatewaybefore 2.5.32.5.3Patch availableCNA
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—2.5.3-1.el8apPatch availableCNA
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—2.5.3-1.el9apPatch availableCNA
  • aap-gateway Vendor— Affected before 2.5.3 Fixed in 2.5.3 Patch available CNA
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 VendorRed Hat Affected — Fixed in 2.5.3-1.el8ap Patch available CNA
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9 VendorRed Hat Affected — Fixed in 2.5.3-1.el9ap Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_automation_platform:2.5:*:*:*:*:*:*:*2.5VulnerableRed Hat
cpe:2.3:a:redhat:ansible_developer:1.2:*:*:*:*:*:*:*1.2VulnerableRed Hat
cpe:2.3:a:redhat:ansible_inside:1.3:*:*:*:*:*:*:*1.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
  • cpe:2.3:a:redhat:ansible_automation_platform:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_developer:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_inside:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat

Remediation

  • Fix · CNA aap-gateway Fixed in 2.5.3

Red Hat 1 advisory

  • RHSA-2024:8534 Released 2024-10-28 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.5 Product Release Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.2-1.el8ap, automation-gateway-server-2.5.3-1.el8ap, receptor-1.4.9-2.el8ap +1
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.2-1.el9ap, automation-gateway-server-2.5.3-1.el9ap, receptor-1.4.9-2.el9ap +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2024:8534
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2024:8534
Not affected: 2 products
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10033
  2. 2026-10-03 Alias added: GHSA-h596-hg59-cxrq

References

Advisory 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-35991 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks KEVCVSS 3.1MEDIUM 6.5
  • TI-2026-34281 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection CVSS 3.1HIGH 7.5
  • TI-2026-28834 jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers CVSS 4.0MEDIUM 6.9
  • TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
  • TI-2023-27712 Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 CVSS 3.1HIGH 7.5
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences