Redhat Freeipa vulnerabilities

5 vulnerabilities

Known vulnerabilities in Redhat Freeipa, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5CVE-2013-0199redhatfreeipa
EPSS score
2.12%
The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.5CVE-2013-0336debian389-ds-base+3
EPSS score
2.76%
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.5CVE-2008-3274redhatenterprise_ipa+8
EPSS score
1.84%
The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query.7.9CVE-2012-5484PyPIfreeipa+10
EPSS score
0.61%
The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate.6.8CVE-2011-3636redhatfreeipa+7
EPSS score
0.81%
Cross-site request forgery (CSRF) vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes.