CyberRota Analysis
AI-GeneratedA vulnerability exists in AWX where the websocket event consumer fails to enforce proper RBAC authorization for certain event groups, specifically inventory_update_events, project_update_events, and system_job_events. This oversight allows any authenticated user to access real-time job output from organizations they should not have access to, potentially exposing sensitive information. Organizations using AWX should prioritize addressing this issue to mitigate unauthorized data exposure risks.
Original NVD Description
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.