CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2023-5455

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 53.2%

CVSS Severity

CVSS v3 Score 6.5

References

Products affected by CVE-2023-5455

Freeipa » Freeipa » Version: N/A

cpe:2.3:a:freeipa:freeipa:-
Freeipa » Freeipa » Version: 0.99-641-20080218

cpe:2.3:a:freeipa:freeipa:0.99-641-20080218
Freeipa » Freeipa » Version: 0.99-698-20080228

cpe:2.3:a:freeipa:freeipa:0.99-698-20080228
Freeipa » Freeipa » Version: 1.0.0

cpe:2.3:a:freeipa:freeipa:1.0.0
Freeipa » Freeipa » Version: 1.1.0

cpe:2.3:a:freeipa:freeipa:1.1.0
Freeipa » Freeipa » Version: 1.1.1

cpe:2.3:a:freeipa:freeipa:1.1.1
Freeipa » Freeipa » Version: 1.2.0

cpe:2.3:a:freeipa:freeipa:1.2.0
Freeipa » Freeipa » Version: 1.2.1

cpe:2.3:a:freeipa:freeipa:1.2.1
Freeipa » Freeipa » Version: 1.2.2

cpe:2.3:a:freeipa:freeipa:1.2.2
Freeipa » Freeipa » Version: 1.9.0

cpe:2.3:a:freeipa:freeipa:1.9.0
Freeipa » Freeipa » Version: 2.0.0

cpe:2.3:a:freeipa:freeipa:2.0.0
Freeipa » Freeipa » Version: 2.1.2

cpe:2.3:a:freeipa:freeipa:2.1.2
Freeipa » Freeipa » Version: 2.1.90

cpe:2.3:a:freeipa:freeipa:2.1.90
Freeipa » Freeipa » Version: 2.2.0

cpe:2.3:a:freeipa:freeipa:2.2.0
Freeipa » Freeipa » Version: 2.2.2

cpe:2.3:a:freeipa:freeipa:2.2.2
Freeipa » Freeipa » Version: 3.0.0

cpe:2.3:a:freeipa:freeipa:3.0.0
Freeipa » Freeipa » Version: 3.1.0

cpe:2.3:a:freeipa:freeipa:3.1.0
Freeipa » Freeipa » Version: 3.1.3

cpe:2.3:a:freeipa:freeipa:3.1.3
Freeipa » Freeipa » Version: 3.1.4

cpe:2.3:a:freeipa:freeipa:3.1.4
Freeipa » Freeipa » Version: 3.1.5

cpe:2.3:a:freeipa:freeipa:3.1.5
Freeipa » Freeipa » Version: 3.2.0

cpe:2.3:a:freeipa:freeipa:3.2.0
Freeipa » Freeipa » Version: 3.2.1

cpe:2.3:a:freeipa:freeipa:3.2.1
Freeipa » Freeipa » Version: 3.2.2

cpe:2.3:a:freeipa:freeipa:3.2.2
Freeipa » Freeipa » Version: 3.3.0

cpe:2.3:a:freeipa:freeipa:3.3.0
Freeipa » Freeipa » Version: 3.3.1

cpe:2.3:a:freeipa:freeipa:3.3.1
Freeipa » Freeipa » Version: 3.3.2

cpe:2.3:a:freeipa:freeipa:3.3.2
Freeipa » Freeipa » Version: 3.3.3

cpe:2.3:a:freeipa:freeipa:3.3.3
Freeipa » Freeipa » Version: 3.3.4

cpe:2.3:a:freeipa:freeipa:3.3.4
Freeipa » Freeipa » Version: 3.3.5

cpe:2.3:a:freeipa:freeipa:3.3.5
Freeipa » Freeipa » Version: 4.0.0

cpe:2.3:a:freeipa:freeipa:4.0.0
Freeipa » Freeipa » Version: 4.0.1

cpe:2.3:a:freeipa:freeipa:4.0.1
Freeipa » Freeipa » Version: 4.0.2

cpe:2.3:a:freeipa:freeipa:4.0.2
Freeipa » Freeipa » Version: 4.0.3

cpe:2.3:a:freeipa:freeipa:4.0.3
Freeipa » Freeipa » Version: 4.0.4

cpe:2.3:a:freeipa:freeipa:4.0.4
Freeipa » Freeipa » Version: 4.0.5

cpe:2.3:a:freeipa:freeipa:4.0.5
Freeipa » Freeipa » Version: 4.1.0

cpe:2.3:a:freeipa:freeipa:4.1.0
Freeipa » Freeipa » Version: 4.1.1

cpe:2.3:a:freeipa:freeipa:4.1.1
Freeipa » Freeipa » Version: 4.1.2

cpe:2.3:a:freeipa:freeipa:4.1.2
Freeipa » Freeipa » Version: 4.1.3

cpe:2.3:a:freeipa:freeipa:4.1.3
Freeipa » Freeipa » Version: 4.1.4

cpe:2.3:a:freeipa:freeipa:4.1.4
Freeipa » Freeipa » Version: 4.1.5

cpe:2.3:a:freeipa:freeipa:4.1.5
Freeipa » Freeipa » Version: 4.10.0

cpe:2.3:a:freeipa:freeipa:4.10.0
Freeipa » Freeipa » Version: 4.10.1

cpe:2.3:a:freeipa:freeipa:4.10.1
Freeipa » Freeipa » Version: 4.10.2

cpe:2.3:a:freeipa:freeipa:4.10.2
Freeipa » Freeipa » Version: 4.11.0

cpe:2.3:a:freeipa:freeipa:4.11.0
Freeipa » Freeipa » Version: 4.2.0

cpe:2.3:a:freeipa:freeipa:4.2.0
Freeipa » Freeipa » Version: 4.2.1

cpe:2.3:a:freeipa:freeipa:4.2.1
Freeipa » Freeipa » Version: 4.2.2

cpe:2.3:a:freeipa:freeipa:4.2.2
Freeipa » Freeipa » Version: 4.2.3

cpe:2.3:a:freeipa:freeipa:4.2.3
Freeipa » Freeipa » Version: 4.2.4

cpe:2.3:a:freeipa:freeipa:4.2.4
Freeipa » Freeipa » Version: 4.3.0

cpe:2.3:a:freeipa:freeipa:4.3.0
Freeipa » Freeipa » Version: 4.3.1

cpe:2.3:a:freeipa:freeipa:4.3.1
Freeipa » Freeipa » Version: 4.3.2

cpe:2.3:a:freeipa:freeipa:4.3.2
Freeipa » Freeipa » Version: 4.3.3

cpe:2.3:a:freeipa:freeipa:4.3.3
Freeipa » Freeipa » Version: 4.4.0

cpe:2.3:a:freeipa:freeipa:4.4.0
Freeipa » Freeipa » Version: 4.4.1

cpe:2.3:a:freeipa:freeipa:4.4.1
Freeipa » Freeipa » Version: 4.4.2

cpe:2.3:a:freeipa:freeipa:4.4.2
Freeipa » Freeipa » Version: 4.4.3

cpe:2.3:a:freeipa:freeipa:4.4.3
Freeipa » Freeipa » Version: 4.4.4

cpe:2.3:a:freeipa:freeipa:4.4.4
Freeipa » Freeipa » Version: 4.5.0

cpe:2.3:a:freeipa:freeipa:4.5.0
Freeipa » Freeipa » Version: 4.5.1

cpe:2.3:a:freeipa:freeipa:4.5.1
Freeipa » Freeipa » Version: 4.5.2

cpe:2.3:a:freeipa:freeipa:4.5.2
Freeipa » Freeipa » Version: 4.5.3

cpe:2.3:a:freeipa:freeipa:4.5.3
Freeipa » Freeipa » Version: 4.5.4

cpe:2.3:a:freeipa:freeipa:4.5.4
Freeipa » Freeipa » Version: 4.6.0

cpe:2.3:a:freeipa:freeipa:4.6.0
Freeipa » Freeipa » Version: 4.6.1

cpe:2.3:a:freeipa:freeipa:4.6.1
Freeipa » Freeipa » Version: 4.6.2

cpe:2.3:a:freeipa:freeipa:4.6.2
Freeipa » Freeipa » Version: 4.6.3

cpe:2.3:a:freeipa:freeipa:4.6.3
Freeipa » Freeipa » Version: 4.6.4

cpe:2.3:a:freeipa:freeipa:4.6.4
Freeipa » Freeipa » Version: 4.6.5

cpe:2.3:a:freeipa:freeipa:4.6.5
Freeipa » Freeipa » Version: 4.6.6

cpe:2.3:a:freeipa:freeipa:4.6.6
Freeipa » Freeipa » Version: 4.6.7

cpe:2.3:a:freeipa:freeipa:4.6.7
Freeipa » Freeipa » Version: 4.6.8

cpe:2.3:a:freeipa:freeipa:4.6.8
Freeipa » Freeipa » Version: 4.6.9

cpe:2.3:a:freeipa:freeipa:4.6.9
Freeipa » Freeipa » Version: 4.7.0

cpe:2.3:a:freeipa:freeipa:4.7.0
Freeipa » Freeipa » Version: 4.7.1

cpe:2.3:a:freeipa:freeipa:4.7.1
Freeipa » Freeipa » Version: 4.7.2

cpe:2.3:a:freeipa:freeipa:4.7.2
Freeipa » Freeipa » Version: 4.7.3

cpe:2.3:a:freeipa:freeipa:4.7.3
Freeipa » Freeipa » Version: 4.7.4

cpe:2.3:a:freeipa:freeipa:4.7.4
Freeipa » Freeipa » Version: 4.7.5

cpe:2.3:a:freeipa:freeipa:4.7.5
Freeipa » Freeipa » Version: 4.7.90

cpe:2.3:a:freeipa:freeipa:4.7.90
Freeipa » Freeipa » Version: 4.8.0

cpe:2.3:a:freeipa:freeipa:4.8.0
Freeipa » Freeipa » Version: 4.8.1

cpe:2.3:a:freeipa:freeipa:4.8.1
Freeipa » Freeipa » Version: 4.8.10

cpe:2.3:a:freeipa:freeipa:4.8.10
Freeipa » Freeipa » Version: 4.8.2

cpe:2.3:a:freeipa:freeipa:4.8.2
Freeipa » Freeipa » Version: 4.8.3

cpe:2.3:a:freeipa:freeipa:4.8.3
Freeipa » Freeipa » Version: 4.8.4

cpe:2.3:a:freeipa:freeipa:4.8.4
Freeipa » Freeipa » Version: 4.8.5

cpe:2.3:a:freeipa:freeipa:4.8.5
Freeipa » Freeipa » Version: 4.8.6

cpe:2.3:a:freeipa:freeipa:4.8.6
Freeipa » Freeipa » Version: 4.8.7

cpe:2.3:a:freeipa:freeipa:4.8.7
Freeipa » Freeipa » Version: 4.8.8

cpe:2.3:a:freeipa:freeipa:4.8.8
Freeipa » Freeipa » Version: 4.8.9

cpe:2.3:a:freeipa:freeipa:4.8.9
Freeipa » Freeipa » Version: 4.9.0

cpe:2.3:a:freeipa:freeipa:4.9.0
Freeipa » Freeipa » Version: 4.9.1

cpe:2.3:a:freeipa:freeipa:4.9.1
Freeipa » Freeipa » Version: 4.9.10

cpe:2.3:a:freeipa:freeipa:4.9.10
Freeipa » Freeipa » Version: 4.9.11

cpe:2.3:a:freeipa:freeipa:4.9.11
Freeipa » Freeipa » Version: 4.9.12

cpe:2.3:a:freeipa:freeipa:4.9.12
Freeipa » Freeipa » Version: 4.9.13

cpe:2.3:a:freeipa:freeipa:4.9.13
Freeipa » Freeipa » Version: 4.9.2

cpe:2.3:a:freeipa:freeipa:4.9.2
Freeipa » Freeipa » Version: 4.9.3

cpe:2.3:a:freeipa:freeipa:4.9.3
Freeipa » Freeipa » Version: 4.9.4

cpe:2.3:a:freeipa:freeipa:4.9.4
Freeipa » Freeipa » Version: 4.9.5

cpe:2.3:a:freeipa:freeipa:4.9.5
Freeipa » Freeipa » Version: 4.9.6

cpe:2.3:a:freeipa:freeipa:4.9.6
Freeipa » Freeipa » Version: 4.9.7

cpe:2.3:a:freeipa:freeipa:4.9.7
Freeipa » Freeipa » Version: 4.9.8

cpe:2.3:a:freeipa:freeipa:4.9.8
Freeipa » Freeipa » Version: 4.9.9

cpe:2.3:a:freeipa:freeipa:4.9.9
Redhat » Codeready Linux Builder » Version: N/A

cpe:2.3:a:redhat:codeready_linux_builder:-
Fedoraproject » Fedora » Version: 38

cpe:2.3:o:fedoraproject:fedora:38
Fedoraproject » Fedora » Version: 39

cpe:2.3:o:fedoraproject:fedora:39
Fedoraproject » Fedora » Version: 40

cpe:2.3:o:fedoraproject:fedora:40
Redhat » Enterprise Linux » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux:7.0
Redhat » Enterprise Linux » Version: 8.0

cpe:2.3:o:redhat:enterprise_linux:8.0
Redhat » Enterprise Linux » Version: 8.4

cpe:2.3:o:redhat:enterprise_linux:8.4
Redhat » Enterprise Linux » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux:9.0
Redhat » Enterprise Linux Desktop » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
Redhat » Enterprise Linux Eus » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_eus:8.6
Redhat » Enterprise Linux Eus » Version: 8.8

cpe:2.3:o:redhat:enterprise_linux_eus:8.8
Redhat » Enterprise Linux Eus » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_eus:9.0
Redhat » Enterprise Linux Eus » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_eus:9.2
Redhat » Enterprise Linux For Arm 64 Eus » Version: 8.8

cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8
Redhat » Enterprise Linux For Arm 64 Eus » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.0
Redhat » Enterprise Linux For Arm 64 Eus » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2
Redhat » Enterprise Linux For Ibm Z Systems » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0
Redhat » Enterprise Linux For Ibm Z Systems » Version: 8.0

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0
Redhat » Enterprise Linux For Ibm Z Systems » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0
Redhat » Enterprise Linux For Ibm Z Systems Eus » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6
Redhat » Enterprise Linux For Ibm Z Systems Eus » Version: 8.8

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8
Redhat » Enterprise Linux For Ibm Z Systems Eus » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.0
Redhat » Enterprise Linux For Ibm Z Systems Eus » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2
Redhat » Enterprise Linux For Power Big Endian » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0
Redhat » Enterprise Linux For Power Little Endian » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0
Redhat » Enterprise Linux For Power Little Endian » Version: 8.0

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0
Redhat » Enterprise Linux For Power Little Endian » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0
Redhat » Enterprise Linux For Power Little Endian Eus » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6
Redhat » Enterprise Linux For Power Little Endian Eus » Version: 8.8

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8
Redhat » Enterprise Linux For Power Little Endian Eus » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0
Redhat » Enterprise Linux For Power Little Endian Eus » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2
Redhat » Enterprise Linux For Scientific Computing » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0
Redhat » Enterprise Linux Server » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_server:9.0
Redhat » Enterprise Linux Server » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_server:9.2
Redhat » Enterprise Linux Server Aus » Version: 8.2

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2
Redhat » Enterprise Linux Server Aus » Version: 8.4

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4
Redhat » Enterprise Linux Server Aus » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6
Redhat » Enterprise Linux Server Aus » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2
Redhat » Enterprise Linux Server For Ibm Z Systems » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_server_for_ibm_z_systems:9.2
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 8.2

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 8.4

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4
Redhat » Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6
Redhat » Enterprise Linux Server Tus » Version: 8.2

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2
Redhat » Enterprise Linux Server Tus » Version: 8.4

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4
Redhat » Enterprise Linux Server Tus » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6
Redhat » Enterprise Linux Server Update Services For Sap Solutions » Version: 8.2

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2
Redhat » Enterprise Linux Server Update Services For Sap Solutions » Version: 8.6

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6
Redhat » Enterprise Linux Server Update Services For Sap Solutions » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.0
Redhat » Enterprise Linux Server Update Services For Sap Solutions » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:9.2
Redhat » Enterprise Linux Update Services For Sap Solutions » Version: 9.0

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0
Redhat » Enterprise Linux Update Services For Sap Solutions » Version: 9.2

cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2
Redhat » Enterprise Linux Workstation » Version: 7.0

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2023-5455

Products

Pricing

Contact Us