CVE-2016-7070 HIGH

CVE-2016-7070

Vendor Red Hat

Product Ansible Tower

Weakness CWE-266

Published September 11, 2018

Last update August 6, 2024

View on NVD All CVEs

CVSS base score

8.0/10

Attack vector Adjacent

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database.

Key dates

02Disclosure timeline

September 11, 2018 CVE published

August 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2016-7070 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html

Related vulnerabilities

04Related CVE

CVE-2023-4153 BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation CVE-2025-26517 CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale) CVE-2024-8253 Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation CVE-2026-44997 OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions CVE-2026-32488 WordPress User Registration plugin <= 4.4.9 - Privilege Escalation vulnerability