Lucene search

[email protected]CVE-2017-11191

HistorySep 28, 2017 - 1:29 a.m.

CVE-2017-11191

2017-09-2801:29:01

CWE-384

[email protected]

web.nvd.nist.gov

cve-2017-11191

freeipa

api

remote authentication

bypass

security issue

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

64.4%

JSON

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and does not recognize this report as a valid security concern

Affected configurations

NVD

Node

freeipafreeipaMatch4.0.0

freeipafreeipaMatch4.0.1

freeipafreeipaMatch4.0.2

freeipafreeipaMatch4.0.3

freeipafreeipaMatch4.0.4

freeipafreeipaMatch4.0.5

freeipafreeipaMatch4.1.0

freeipafreeipaMatch4.1.1

freeipafreeipaMatch4.1.2

freeipafreeipaMatch4.1.3

freeipafreeipaMatch4.1.4

freeipafreeipaMatch4.2.0

freeipafreeipaMatch4.2.1

freeipafreeipaMatch4.2.2

freeipafreeipaMatch4.2.3

freeipafreeipaMatch4.2.4

freeipafreeipaMatch4.3.0

freeipafreeipaMatch4.3.1

freeipafreeipaMatch4.3.2

freeipafreeipaMatch4.3.3

freeipafreeipaMatch4.4.0

freeipafreeipaMatch4.4.1

freeipafreeipaMatch4.4.2

freeipafreeipaMatch4.4.3

freeipafreeipaMatch4.4.4

freeipafreeipaMatch4.5.0

freeipafreeipaMatch4.5.1

freeipafreeipaMatch4.5.2

freeipafreeipaMatch4.5.3

freeipafreeipaMatch4.6.0

freeipafreeipaMatch4.6.1

CPENameOperatorVersion
freeipa:freeipafreeipaeq4.0.0
freeipa:freeipafreeipaeq4.0.1
freeipa:freeipafreeipaeq4.0.2
freeipa:freeipafreeipaeq4.0.3
freeipa:freeipafreeipaeq4.0.4
freeipa:freeipafreeipaeq4.0.5
freeipa:freeipafreeipaeq4.1.0
freeipa:freeipafreeipaeq4.1.1
freeipa:freeipafreeipaeq4.1.2
freeipa:freeipafreeipaeq4.1.3

CPE	Name	Operator	Version
freeipa:freeipa	freeipa	eq	4.0.0
freeipa:freeipa	freeipa	eq	4.0.1
freeipa:freeipa	freeipa	eq	4.0.2
freeipa:freeipa	freeipa	eq	4.0.3
freeipa:freeipa	freeipa	eq	4.0.4
freeipa:freeipa	freeipa	eq	4.0.5
freeipa:freeipa	freeipa	eq	4.1.0
freeipa:freeipa	freeipa	eq	4.1.1
freeipa:freeipa	freeipa	eq	4.1.2
freeipa:freeipa	freeipa	eq	4.1.3

Rows per page:

1-10 of 311

References

packetstormsecurity.com/files/143532/FreeIPA-2.213-Session-Hijacking.html

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

64.4%

JSON

Related for CVE-2017-11191

packetstorm1 ubuntucve1 cvelist1 prion1 nvd1 redhatcve1