CVE-2016-5404

6.5 mediumEPSS 2.6%

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2016-09-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fedoraproject:fedora
freeipa:freeipa
oracle:linux

References

http://rhn.redhat.com/errata/RHSA-2016-1797.html
http://www.openwall.com/lists/oss-security/2016/08/17/9
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.securityfocus.com/bid/92525
https://fedorahosted.org/freeipa/ticket/6232

Check your stack JSON