CVE-2023-5455
- ULN >
- Oracle Linux CVE repository >
- CVE-2023-5455
CVE Details
| Release Date: | 2024-01-10 |
Description
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
See more information about CVE-2023-5455 from MITRE CVE dictionary and NIST NVD
CVSS v3.0 metrics
NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.
| Base Score: | 6.5 | Base Metrics: | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| Access Vector: | Network | Attack Complexity: | Low |
| Privileges Required: | None | User Interaction: | Required |
| Scope: | Unchanged | Confidentiality Impact: | None |
| Integrity Impact: | High | Availability Impact: | None |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 7 (ipa) | ELSA-2024-0145 | 2024-01-10 |
| Oracle Linux version 8 (bind-dyndb-ldap) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (custodia) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (ipa) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (ipa-healthcheck) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (opendnssec) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-jwcrypto) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-kdcproxy) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-qrcode) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-yubico) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (pyusb) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (slapi-nis) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (softhsm) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 9 (ipa) | ELSA-2024-0141 | 2024-01-11 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
