A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-bind-dyndb-ldapalma-upgrade-custodiaalma-upgrade-ipa-clientalma-upgrade-ipa-client-commonalma-upgrade-ipa-client-epnalma-upgrade-ipa-client-sambaalma-upgrade-ipa-commonalma-upgrade-ipa-healthcheckalma-upgrade-ipa-healthcheck-corealma-upgrade-ipa-python-compatalma-upgrade-ipa-selinuxalma-upgrade-ipa-serveralma-upgrade-ipa-server-commonalma-upgrade-ipa-server-dnsalma-upgrade-ipa-server-trust-adalma-upgrade-opendnssecalma-upgrade-python3-custodiaalma-upgrade-python3-ipaclientalma-upgrade-python3-ipalibalma-upgrade-python3-ipaserveralma-upgrade-python3-ipatestsalma-upgrade-python3-jwcryptoalma-upgrade-python3-kdcproxyalma-upgrade-python3-pyusbalma-upgrade-python3-qrcodealma-upgrade-python3-qrcode-corealma-upgrade-python3-yubicoalma-upgrade-slapi-nisalma-upgrade-softhsmalma-upgrade-softhsm-devel | Jan 15, 2024 | Jan 10, 2024 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-ipa-clientamazon-linux-ami-2-upgrade-ipa-client-commonamazon-linux-ami-2-upgrade-ipa-commonamazon-linux-ami-2-upgrade-ipa-debuginfoamazon-linux-ami-2-upgrade-ipa-python-compatamazon-linux-ami-2-upgrade-ipa-serveramazon-linux-ami-2-upgrade-ipa-server-commonamazon-linux-ami-2-upgrade-ipa-server-dnsamazon-linux-ami-2-upgrade-ipa-server-trust-adamazon-linux-ami-2-upgrade-python2-ipaclientamazon-linux-ami-2-upgrade-python2-ipalibamazon-linux-ami-2-upgrade-python2-ipaserver | Feb 21, 2024 | Jan 10, 2024 | |
| Centos_linux | — | centos-upgrade-ipa-clientcentos-upgrade-ipa-client-commoncentos-upgrade-ipa-commoncentos-upgrade-ipa-debuginfocentos-upgrade-ipa-python-compatcentos-upgrade-ipa-servercentos-upgrade-ipa-server-commoncentos-upgrade-ipa-server-dnscentos-upgrade-ipa-server-trust-adcentos-upgrade-python2-ipaclientcentos-upgrade-python2-ipalibcentos-upgrade-python2-ipaserver | Jan 11, 2024 | Jan 10, 2024 |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Jan 10, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-bind-dyndb-ldaporacle-linux-upgrade-custodiaoracle-linux-upgrade-ipa-clientoracle-linux-upgrade-ipa-client-commonoracle-linux-upgrade-ipa-client-epnoracle-linux-upgrade-ipa-client-sambaoracle-linux-upgrade-ipa-commonoracle-linux-upgrade-ipa-healthcheckoracle-linux-upgrade-ipa-healthcheck-coreoracle-linux-upgrade-ipa-python-compatoracle-linux-upgrade-ipa-selinuxoracle-linux-upgrade-ipa-serveroracle-linux-upgrade-ipa-server-commonoracle-linux-upgrade-ipa-server-dnsoracle-linux-upgrade-ipa-server-trust-adoracle-linux-upgrade-opendnssecoracle-linux-upgrade-python2-ipaclientoracle-linux-upgrade-python2-ipaliboracle-linux-upgrade-python2-ipaserveroracle-linux-upgrade-python3-custodiaoracle-linux-upgrade-python3-ipaclientoracle-linux-upgrade-python3-ipaliboracle-linux-upgrade-python3-ipaserveroracle-linux-upgrade-python3-ipatestsoracle-linux-upgrade-python3-jwcryptooracle-linux-upgrade-python3-kdcproxyoracle-linux-upgrade-python3-pyusboracle-linux-upgrade-python3-qrcodeoracle-linux-upgrade-python3-qrcode-coreoracle-linux-upgrade-python3-yubicooracle-linux-upgrade-slapi-nisoracle-linux-upgrade-softhsmoracle-linux-upgrade-softhsm-devel | Jan 11, 2024 | Jan 10, 2024 |
| Redhat_linux | redhat-upgrade-bind-dyndb-ldapredhat-upgrade-bind-dyndb-ldap-debuginforedhat-upgrade-bind-dyndb-ldap-debugsourceredhat-upgrade-custodiaredhat-upgrade-ipa-clientredhat-upgrade-ipa-client-commonredhat-upgrade-ipa-client-debuginforedhat-upgrade-ipa-client-epnredhat-upgrade-ipa-client-sambaredhat-upgrade-ipa-commonredhat-upgrade-ipa-debuginforedhat-upgrade-ipa-debugsourceredhat-upgrade-ipa-healthcheckredhat-upgrade-ipa-healthcheck-coreredhat-upgrade-ipa-python-compatredhat-upgrade-ipa-selinuxredhat-upgrade-ipa-serverredhat-upgrade-ipa-server-commonredhat-upgrade-ipa-server-debuginforedhat-upgrade-ipa-server-dnsredhat-upgrade-ipa-server-trust-adredhat-upgrade-ipa-server-trust-ad-debuginforedhat-upgrade-krb5-debuginforedhat-upgrade-krb5-debugsourceredhat-upgrade-krb5-develredhat-upgrade-krb5-devel-debuginforedhat-upgrade-krb5-libsredhat-upgrade-krb5-libs-debuginforedhat-upgrade-krb5-pkinitredhat-upgrade-krb5-pkinit-debuginforedhat-upgrade-krb5-serverredhat-upgrade-krb5-server-debuginforedhat-upgrade-krb5-server-ldapredhat-upgrade-krb5-server-ldap-debuginforedhat-upgrade-krb5-workstationredhat-upgrade-krb5-workstation-debuginforedhat-upgrade-libkadm5redhat-upgrade-libkadm5-debuginforedhat-upgrade-opendnssecredhat-upgrade-opendnssec-debuginforedhat-upgrade-opendnssec-debugsourceredhat-upgrade-python2-ipaclientredhat-upgrade-python2-ipalibredhat-upgrade-python2-ipaserverredhat-upgrade-python3-custodiaredhat-upgrade-python3-ipaclientredhat-upgrade-python3-ipalibredhat-upgrade-python3-ipaserverredhat-upgrade-python3-ipatestsredhat-upgrade-python3-jwcryptoredhat-upgrade-python3-kdcproxyredhat-upgrade-python3-pyusbredhat-upgrade-python3-qrcoderedhat-upgrade-python3-qrcode-coreredhat-upgrade-python3-yubicoredhat-upgrade-slapi-nisredhat-upgrade-slapi-nis-debuginforedhat-upgrade-slapi-nis-debugsourceredhat-upgrade-softhsmredhat-upgrade-softhsm-debuginforedhat-upgrade-softhsm-debugsourceredhat-upgrade-softhsm-devel | Jan 11, 2024 | Jan 10, 2024 | |
| Rocky_linux | rocky-upgrade-opendnssecrocky-upgrade-opendnssec-debuginforocky-upgrade-opendnssec-debugsourcerocky-upgrade-slapi-nisrocky-upgrade-slapi-nis-debuginforocky-upgrade-slapi-nis-debugsourcerocky-upgrade-softhsmrocky-upgrade-softhsm-debuginforocky-upgrade-softhsm-debugsourcerocky-upgrade-softhsm-devel | Aug 15, 2024 | Jan 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub