Orta CVSS 6.5
CVE-2023-5455: Freeipa: siteler arası istek sahteciliği (CSRF)
Açıklama (NVD)
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
Özet bilgiler
- Ürün
- Freeipa Freeipa
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - EPSS
- %0,57 (yüzdelik 48)
- CWE
- CWE-352
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| freeipa-freeipa | — | — | 4.6.10 |
| freeipa-freeipa | 4.7.0 | — | 4.9.14 |
| freeipa-freeipa | 4.10.0 | — | 4.10.3 |
| freeipa-freeipa | 4.11.0 | 4.11.0 | — |
| freeipa-freeipa | 4.11.0 | 4.11.0 | — |
| fedoraproject-fedora | 38 | 38 | — |
| fedoraproject-fedora | 39 | 39 | — |
| fedoraproject-fedora | 40 | 40 | — |
| redhat-codeready-linux-builder | — | — | — |
| redhat-enterprise-linux | 7.0 | 7.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 8.4 | 8.4 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
| redhat-enterprise-linux-desktop | 7.0 | 7.0 | — |
| redhat-enterprise-linux-eus | 8.6 | 8.6 | — |
| redhat-enterprise-linux-eus | 8.6 | 8.6 | — |
| redhat-enterprise-linux-eus | 8.8 | 8.8 | — |
| redhat-enterprise-linux-eus | 9.0 | 9.0 | — |
| redhat-enterprise-linux-eus | 9.2 | 9.2 | — |
| redhat-enterprise-linux-for-arm-64-eus | 8.8 | 8.8 | — |
| redhat-enterprise-linux-for-arm-64-eus | 9.0 | 9.0 | — |
| redhat-enterprise-linux-for-arm-64-eus | 9.2 | 9.2 | — |
| redhat-enterprise-linux-for-ibm-z-systems | 7.0 | 7.0 | — |
| redhat-enterprise-linux-for-ibm-z-systems | 8.0 | 8.0 | — |
| redhat-enterprise-linux-for-ibm-z-systems | 9.0 | 9.0 | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 8.6 | 8.6 | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 8.8 | 8.8 | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 9.0 | 9.0 | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 9.2 | 9.2 | — |
Kaynaklar
- NVD kaydı
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- www.freeipa.org
- www.freeipa.org
- www.freeipa.org
- www.freeipa.org
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- CWE-352