title: CVE-2022-3205 Controller: Cross site scripting in automation controller UI
description: Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection
problem types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
collection_url: ansible-tower
cpes: cpe:/a:redhat:ansible_automation_platform
defaultStatus: affected
product: Red Hat Ansible Automation Platform 1.2
vendor: Red Hat
x_redhatStatus: Affected
versions:
version: 1.2, status: affected
}
{
collection_url: automation-controller
cpes: cpe:/a:redhat:ansible_automation_platform:2.0::el8
defaultStatus: affected
product: Red Hat Ansible Automation Platform 2.0
vendor: Red Hat
x_redhatStatus: Affected
versions:
version: 2.0, status: affected
}
metrics:
other: [
content: {'namespace': 'https://access.redhat.com/security/updates/classification/', 'value': 'Moderate'}
type: Red Hat severity rating
]