CVE-2023-5455
- ULN >
- Oracle Linux CVE repository >
- CVE-2023-5455
CVE Details
| Release Date: | 2024-01-10 | |
| Impact: | Moderate | What is this? |
Description
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
See more information about CVE-2023-5455 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 metrics
| Base Score: | 6.5 |
| Vector String: | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| Version: | 3.0 |
| Attack Vector: | Network |
| Attack Complexity: | Low |
| Privileges Required: | None |
| User Interaction: | Required |
| Scope: | Unchanged |
| Confidentiality Impact: | None |
| Integrity Impact: | High |
| Availability Impact: | None |
Errata information
| Platform | Errata | Release Date |
| Oracle Linux version 7 (ipa) | ELSA-2024-0145 | 2024-01-10 |
| Oracle Linux version 8 (bind-dyndb-ldap) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (custodia) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (ipa) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (ipa-healthcheck) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (opendnssec) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-jwcrypto) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-kdcproxy) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-qrcode) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (python-yubico) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (pyusb) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (slapi-nis) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 8 (softhsm) | ELSA-2024-0143 | 2024-01-12 |
| Oracle Linux version 9 (ipa) | ELSA-2024-0141 | 2024-01-11 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections:
- Oracle customers - enter a support request
- Vulnerability scanning tools vendors and project maintainers - follow the standard ISV process
