CVE-2023-3971: Controller: html injection in custom login info

Description

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.

Scores

CVSS scores of CVE-2023-3971, by who scored it
Scored by	CVSS	Score	Vector
redhatCNA (assigner)	3.1	High7.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVDNVD · Modified	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.82% · top 43% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Weakness

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (opens in a new tab)All about CWE-80 and its CVEs
CWE-79 (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Red Hat · Red Hat Ansible Automation Platform 2.3 for RHEL 8
- unaffected 0:4.3.11-1.el8ap – < *
Red Hat · Red Hat Ansible Automation Platform 2.3 for RHEL 9
- unaffected 0:4.3.11-1.el9ap – < *
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 8
- unaffected 0:4.4.1-1.el8ap – < *
Red Hat · Red Hat Ansible Automation Platform 2.4 for RHEL 9
- unaffected 0:4.4.1-1.el9ap – < *

References (4)

RHSA-2023:4340 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2023:4590 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
https://access.redhat.com/security/cve/CVE-2023-3971 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
RHBZ#2226965 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-3971](https://trackcve.app/badge/CVE-2023-3971.svg)](https://trackcve.app/cve/CVE-2023-3971)

Record last updated 20 Nov 2025, 19:51 UTC.