FreeIPA 3.3.1

CPE Details

FreeIPA 3.3.1
freeipa
freeipa
3.3.1
2019-07-03
12h45 +00:00
2019-07-03
12h45 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:freeipa:freeipa:3.3.1:*:*:*:*:*:*:*

Informations

Vendor

freeipa

Product

freeipa

Version

3.3.1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-5455 2024-01-10
12h33 +00:00		 A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
6.5
Medium
CVE-2017-2590 2018-07-27
16h00 +00:00		 A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
8.1
High
CVE-2015-5284 2017-09-21
12h00 +00:00		 ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
9.8
Critical
CVE-2015-5179 2017-09-20
14h00 +00:00		 FreeIPA might display user data improperly via vectors involving non-printable characters.
7.5
High
CVE-2015-1827 2015-03-30
12h00 +00:00		 The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
5