CyberRota Analysis
AI-GeneratedThe OCAPI modules in the community.general Ansible collection are vulnerable due to the disabling of TLS certificate validation, which allows attackers on the network path to intercept and manipulate requests. This flaw poses a risk of credential theft and unauthorized access, particularly for environments utilizing HTTP Basic Authentication. Organizations using these Ansible modules should prioritize remediation to protect sensitive data and maintain secure communications with OCAPI-managed devices.
Original NVD Description
A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and the modules expose no parameter to re-enable it, while sending HTTP Basic-Auth credentials to an https endpoint. An attacker positioned on the network path between the Ansible controller and the OCAPI-managed storage/enclosure device can present any certificate, intercept the session, capture the credentials, and tamper with responses.