CVE-2023-3971: Red Hat Ansible Automation Controller

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Affected products

• Red Hat Ansible Automation Controller: before 4.3.11 (fixed in 4.3.11); version 4.4 only
• Red Hat Ansible Automation Platform: version 2.3 only; version 2.4 only
• Red Hat Ansible Developer: version 1.0 only
• Red Hat Ansible Inside: version 1.1 only

Published 2023-10-04. Last modified 2026-06-17.