CVE-2023-5455: Ipa: invalid csrf protection

Modified

AliasesRHSA-2024:0138RHSA-2024:0140RHSA-2024:0141+5 more

Published 10-01-2024Last modified 18-03-2026

Vulnerability summary

CVE-2023-5455 is a medium (CVSS 6.5) Cross-Site Request Forgery vulnerability in fedoraproject fedora. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.57%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4

RHSA-2024:0137 RHSA-2024:0139 RHSA-2024:0143 RHSA-2024:0252

Timeline

10-01-2024
PublishedVulnerability first disclosed.
18-03-2026
Last modifiedVulnerability information updated.

Description

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.5

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.57% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-352Cross-Site Request ForgeryThe web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat73 products

codeready_linux_builderna
enterprise_linuxEOL7.0 | 8.0 | 8.4 | 9.0
enterprise_linux_desktop7.0
enterprise_linux_eus8.6 | 8.8 | 9.0 | 9.2
enterprise_linux_for_arm_64_eus8.8 | 9.0 | 9.2

enterprise_linux_for_ibm_z_systems7.0 | 8.0 | 9.0
enterprise_linux_for_ibm_z_systems_eus8.6 | 8.8 | 9.0 | 9.2
enterprise_linux_for_power_big_endian7.0
enterprise_linux_for_power_little_endian7.0 | 8.0 | 9.0
enterprise_linux_for_power_little_endian_eus8.6 | 8.8 | 9.0 | 9.2
enterprise_linux_for_scientific_computing7.0
enterprise_linux_server9.0 | 9.2
enterprise_linux_server_aus8.2 | 8.4 | 8.6 | 9.2
enterprise_linux_server_for_ibm_z_systems9.2
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.2 | 8.4 | 8.6
enterprise_linux_server_tus8.2 | 8.4 | 8.6
enterprise_linux_server_update_services_for_sap_solutions8.2 | 8.6 | 9.0 | 9.2
enterprise_linux_update_services_for_sap_solutions9.0 | 9.2
enterprise_linux_workstation7.0
bind-dyndb-ldap< 0:11.6-2.module+el8.4.0+9328+4ec4e316 | < 0:11.2-3.module+el8.2.0+4921+923e30d5
bind-dyndb-ldap-debuginfo< 0:11.6-2.module+el8.4.0+9328+4ec4e316 | < 0:11.2-3.module+el8.2.0+4921+923e30d5
bind-dyndb-ldap-debugsource< 0:11.6-2.module+el8.4.0+9328+4ec4e316 | < 0:11.2-3.module+el8.2.0+4921+923e30d5
custodia< 0:0.6.0-3.module+el8.1.0+4098+f286395e
ipa< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-client< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-client-common< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-client-debuginfo< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
ipa-client-epn< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2
ipa-client-samba< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
ipa-common< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-debuginfo< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-debugsource< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
ipa-healthcheck< 0:0.7-3.module+el8.4.0+9007+5084bdd8 | < 0:0.4-4.module+el8.2.0+5489+95477d9f
ipa-healthcheck-core< 0:0.7-3.module+el8.4.0+9007+5084bdd8 | < 0:0.4-4.module+el8.2.0+5489+95477d9f
ipa-idoverride-memberof< 0:0.0.4-6.module+el8.1.0+4098+f286395e
ipa-idoverride-memberof-plugin< 0:0.0.4-6.module+el8.1.0+4098+f286395e
ipa-python-compat< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-selinux< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2
ipa-server< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-server-common< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-server-debuginfo< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
ipa-server-dns< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-server-trust-ad< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed | < 0:4.6.8-5.el7_9.16
ipa-server-trust-ad-debuginfo< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
opendnssec< 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 | < 0:1.4.14-1.module+el8.1.0+4098+f286395e
opendnssec-debuginfo< 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 | < 0:1.4.14-1.module+el8.1.0+4098+f286395e
opendnssec-debugsource< 0:2.1.7-1.module+el8.4.0+9007+5084bdd8 | < 0:1.4.14-1.module+el8.1.0+4098+f286395e
python-jwcrypto< 0:0.5.0-1.module+el8.1.0+4098+f286395e
python-kdcproxy< 0:0.4-5.module+el8.2.0+4691+a05b2456
python-qrcode< 0:5.1-12.module+el8.1.0+4098+f286395e
python-yubico< 0:1.3.2-9.module+el8.1.0+4098+f286395e
python2-ipaclient< 0:4.6.8-5.el7_9.16
python2-ipalib< 0:4.6.8-5.el7_9.16
python2-ipaserver< 0:4.6.8-5.el7_9.16
python3-custodia< 0:0.6.0-3.module+el8.1.0+4098+f286395e
python3-ipaclient< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
python3-ipalib< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
python3-ipaserver< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2 | < 0:4.8.4-14.module+el8.2.0+20745+1d1ce1ed
python3-ipatests< 0:4.9.2-10.module+el8.4.0+20744+ffd02a6d | < 0:4.9.8-9.el9_0 | < 0:4.10.2-5.el9_3 | < 0:4.10.1-10.el9_2
python3-jwcrypto< 0:0.5.0-1.module+el8.1.0+4098+f286395e
python3-kdcproxy< 0:0.4-5.module+el8.2.0+4691+a05b2456
python3-pyusb< 0:1.0.0-9.module+el8.1.0+4098+f286395e
python3-qrcode< 0:5.1-12.module+el8.1.0+4098+f286395e
python3-qrcode-core< 0:5.1-12.module+el8.1.0+4098+f286395e
python3-yubico< 0:1.3.2-9.module+el8.1.0+4098+f286395e
pyusb< 0:1.0.0-9.module+el8.1.0+4098+f286395e
slapi-nis< 0:0.56.6-2.1.module+el8.4.0+12579+0538eac8 | < 0:0.56.3-3.module+el8.2.0+10782+8facb0b2
slapi-nis-debuginfo< 0:0.56.6-2.1.module+el8.4.0+12579+0538eac8 | < 0:0.56.3-3.module+el8.2.0+10782+8facb0b2
slapi-nis-debugsource< 0:0.56.6-2.1.module+el8.4.0+12579+0538eac8 | < 0:0.56.3-3.module+el8.2.0+10782+8facb0b2
softhsm< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f
softhsm-debuginfo< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f
softhsm-debugsource< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f
softhsm-devel< 0:2.6.0-5.module+el8.4.0+10227+076cd560 | < 0:2.4.0-4.module+el8.2.0+5779+a38c524f

Show all 73

Debian1 product

freeipaAll versions (No fix recorded) | < 4.11.1-1

Fedoraproject1 product

fedoraEOL38 | 39 | 40

Freeipa1 product

freeipa< 4.6.10 | ≥ 4.7.0, < 4.9.14 | ≥ 4.10.0, < 4.10.3 | 4.11.0 | 4.11.0:beta1

Ubuntu1 product

freeipaAll versions (No fix recorded)

5 vendors · 77 products

References

29 links

access.redhat.com/errata/RHSA-2024:0137Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2024:0138Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2024:0139Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2024:0140Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2024:0141Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2024:0142Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2024:0143Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2024:0144Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2024:0145Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
access.redhat.com/security/cve/CVE-2023-5455VDB EntryX Refsource REDHATREPORTThird Party Advisory

Show all 29 references

bugzilla.redhat.com/show_bug.cgi?id=2242828Issue TrackingX Refsource REDHATREPORTThird Party Advisory
www.freeipa.org/release-notes/4-10-3.htmlARTICLEREPORTRelease Notes
www.freeipa.org/release-notes/4-11-1.htmlARTICLEREPORTRelease Notes
www.freeipa.org/release-notes/4-6-10.htmlARTICLEREPORTRelease Notes
www.freeipa.org/release-notes/4-9-14.htmlARTICLEREPORTRelease Notes
access.redhat.com/errata/RHSA-2024:0252Vendor AdvisoryX Refsource REDHATX TransferredThird Party Advisory
lists.fedoraproject.org/archives/…X Transferred
lists.fedoraproject.org/archives/…X Transferred
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0138.jsonAdvisory
www.cve.org/CVERecord?id=CVE-2023-5455AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2023-5455Advisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0140.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0141.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0142.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0144.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0145.jsonAdvisory
ubuntu.com/security/CVE-2023-5455REPORT
security-tracker.debian.org/tracker/CVE-2023-5455Advisory