CWE Code: 532
Vulnerability Type: privilege_escalation
CVSS Score: 2.1
CWE Name:  Inclusion of Sensitive Information in Log Files
Summary: execution of ansible playbooks on windows platforms with powershell scriptblock logging and module logging enabled can allow for 'become' passwords to appear in eventlogs in plaintext. a local user with administrator privileges on the machine can view these logs and discover the plaintext password. ansible engine 2.8 and older are believed to be vulnerable.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2018-11-29
Last Modified Date: 2019-04-03