CVE-2020-14329: 
Ansible Tower vulnerability analysis and mitigation

A data exposure vulnerability (CVE-2020-14329) was discovered in Ansible Tower versions before 3.7.2. The vulnerability allows users from other organizations in the system to retrieve any label from the organization and disclose organization names through the /api/v2/labels/ endpoint. The vulnerability was discovered by Maxime ESCOURBIAC from the Michelin CERT team and was addressed in August 2020 (Red Hat Advisory).

The vulnerability exists in the /api/v2/labels/ endpoint of Ansible Tower, which was accessible to all logged-in users in the system. The endpoint's response contained labels from organizations that the user should not normally have access to, along with organization names. The vulnerability received a CVSS v3.1 Base Score of 3.3 (LOW) with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The primary impact of this vulnerability is to data confidentiality. Authenticated users could access labels and organization names from organizations they were not authorized to view, potentially exposing sensitive organizational information (Red Hat Bugzilla).

The vulnerability requires an attacker to be authenticated in the system with basic user access. Once authenticated, they can access the vulnerable endpoint to retrieve unauthorized information from other organizations (NVD).

The vulnerability was fixed in Ansible Tower version 3.7.2. Organizations running affected versions should upgrade to version 3.7.2 or later to address this security issue (Red Hat Advisory).