CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVE-2023-5455
Medium (6.5). EPSS 0.6% chance of exploitation in the next 30 days.
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- freeipa:freeipa
- redhat:codeready_linux_builder
- redhat:enterprise_linux
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_for_arm_64_eus
- redhat:enterprise_linux_for_ibm_z_systems
- redhat:enterprise_linux_for_ibm_z_systems_eus
- redhat:enterprise_linux_for_power_big_endian
- redhat:enterprise_linux_for_power_little_endian
- redhat:enterprise_linux_for_power_little_endian_eus
- redhat:enterprise_linux_for_scientific_computing
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_for_ibm_z_systems
- redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_server_update_services_for_sap_solutions
- redhat:enterprise_linux_update_services_for_sap_solutions
- redhat:enterprise_linux_workstation