Описание
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
Отчет
The CSRF vulnerability in ipa/session/login_password is considered a moderate issue due to the need for the attacker to trick users into submitting a request. This implies that exploitation requires user interaction for a new authentication attempt, rather than reflecting a cookie for an already logged-in user. While the vulnerability could result in a loss of confidentiality and system integrity, the specific actions and their severity are not explicitly detailed. The moderate classification suggests that, while serious, the limitations on exploitation conditions and potential impact contribute to a moderate overall severity.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ipa | Out of support scope | ||
| Red Hat Enterprise Linux 8 | idm:client/ipa | Not affected | ||
| Red Hat Enterprise Linux 8 | krb5 | Affected | ||
| Red Hat Enterprise Linux 7 | ipa | Fixed | RHSA-2024:0145 | 10.01.2024 |
| Red Hat Enterprise Linux 8 | idm | Fixed | RHSA-2024:0143 | 10.01.2024 |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | idm | Fixed | RHSA-2024:0144 | 10.01.2024 |
| Red Hat Enterprise Linux 8.2 Telecommunications Update Service | idm | Fixed | RHSA-2024:0144 | 10.01.2024 |
| Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | idm | Fixed | RHSA-2024:0144 | 10.01.2024 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | idm | Fixed | RHSA-2024:0138 | 10.01.2024 |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | idm | Fixed | RHSA-2024:0138 | 10.01.2024 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
A Cross-site request forgery vulnerability exists in ipa/session/login ...
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
6.5 Medium
CVSS3