CVE-2019-14826: freeipa Insufficient Session Expiration
CVSS: 5.6v3.0MediumModified
AliasesUBUNTU-CVE-2019-14826DEBIAN-CVE-2019-14826CGA-2gg5-x796-2p8mCGA-38c9-hx8j-87ccCGA-5r6v-mw8h-74rrCGA-5vvq-x8g5-pfgpCGA-6c8q-vpg4-9qw3CGA-78fj-9h4x-r87xCGA-8328-v5gh-h384CGA-8j23-6g7x-mfwjCGA-f72c-q54j-g66rCGA-fp3g-83fq-gwxxCGA-h8mr-gg9h-q5h4CGA-mf34-xpgx-rxp5CGA-q8xc-c2qj-qrqxCGA-qq9h-q32v-q988CGA-rc8m-ghrv-239pCGA-xqr6-qhmf-7gxh
Published 17-09-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-14826 is a medium (CVSS 5.6) Insufficient Session Expiration vulnerability in freeipa. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.5% of scored vulnerabilities.
CVSS score
5.6/10
010
Medium · v3.0 (CVE.org)EPSS score
0.34%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 17-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.
CVSS metrics
8 scores · 5 sources · 3 versionsMedium 4.4Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated4.4MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Medium 5.6Preferred score · CVE.org (CNA)
CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:NSourcesAll 3 agree
- NVDNIST5.6MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated5.6MediumCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 19-09-2026
19-09-202619-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- freeipaAll versions (No fix recorded)
- freeipa-docAll versions (No fix recorded)
- py3.13-ipaclientAll versions (No fix recorded)
- py3.13-ipalibAll versions (No fix recorded)
- py3.13-ipaplatformAll versions (No fix recorded)
Debian1 product
- freeipaAll versions (No fix recorded)
Freeipa1 product
- freeipa≥ 4.5.0 (No fix recorded)
Red hat1 product
- ipaFreeIPA versions 4.5.0 and later
Redhat1 product
- enterprise_linuxEOL7.0 | 8.0
Ubuntu1 product
- freeipaAll versions (No fix recorded)
6 vendors · 13 products
References
5 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14826X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
