CVE-2016-5404: fedoraproject fedora Improper Access Control
CVSS: 6.5v3.0MediumModified
AliasesRHSA-2016:1797UBUNTU-CVE-2016-5404DEBIAN-CVE-2016-5404CGA-2626-q8qr-9rgpCGA-54v5-pg74-fqx8CGA-62w4-44vv-3jq3CGA-79v5-x32w-gj6wCGA-7cw9-989m-4cxfCGA-97gr-c3rm-4qchCGA-c3vf-hxrw-fpqhCGA-c5j2-f926-gq54CGA-gq59-qxmh-vrm7CGA-hcfc-cr9x-rhx8CGA-hhr6-j75c-296rCGA-p797-8qgh-jmr4CGA-p95x-f3gg-rgfvCGA-pj77-g2w4-4rx2CGA-q94m-95v8-qg84CGA-rgf8-696x-7jw3
Published 07-09-2016Last modified 06-08-2024
Vulnerability summary
CVE-2016-5404 is a medium (CVSS 6.5) Improper Access Control vulnerability in fedoraproject fedora. EPSS estimates a 2.58% chance of exploitation in the next 30 days, higher than 85% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.0 (NVD)EPSS score
2.58%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 07-09-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSources5 sources · 4.3–6.5
- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.58%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.58% on 20-09-2026
20-09-202620-10-2026
EPSS score2.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- ipa< 0:3.0.0-50.el6_8.2 | < 0:4.2.0-15.el7_2.19
- ipa-admintools< 0:3.0.0-50.el6_8.2 | < 0:4.2.0-15.el7_2.19
- ipa-client< 0:3.0.0-50.el6_8.2 | < 0:4.2.0-15.el7_2.19
- ipa-debuginfo< 0:3.0.0-50.el6_8.2 | < 0:4.2.0-15.el7_2.19
- ipa-python< 0:3.0.0-50.el6_8.2 | < 0:4.2.0-15.el7_2.19
Chainguard8 products
- freeipa< 4.12.5-r0
- freeipa-doc< 4.12.5-r0
- py3.13-ipaclient< 4.12.5-r0
- py3.13-ipalib< 4.12.5-r0
- py3.13-ipaplatform< 4.12.5-r0
Debian1 product
- freeipa< 4.3.2-5
Fedoraproject1 product
- fedoraEOL23 | 24 | 25
Freeipa1 product
- freeipana
Oracle1 product
- linuxEOL6 | 7
Ubuntu1 product
- freeipa< 4.3.1-0ubuntu1+esm1
7 vendors · 22 products
References
19 links- www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlX Refsource CONFIRMThird Party AdvisoryAdvisory
- git.fedorahosted.org/cgit/freeipa.git/commit/?id=cf74584d0f772f3f5eccc1d30c001e4212a104fdX Refsource CONFIRMIssue TrackingPatchFIX
- www.openwall.com/lists/oss-security/2016/08/17/9Mailing ListX Refsource MLISTThird Party AdvisoryAdvisory
