mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
464 lines
24 KiB
JSON
464 lines
24 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2023-5455",
|
|
"ASSIGNER": "secalert@redhat.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "Cross-Site Request Forgery (CSRF)",
|
|
"cweId": "CWE-352"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "Red Hat",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 7",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "0:4.6.8-5.el7_9.16",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8090020231201152514.3387e3d0",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
},
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"defaultStatus": "unaffected"
|
|
}
|
|
},
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8020020231123154806.792f4060",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8020020231123154806.792f4060",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8020020231123154806.792f4060",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8040020231123154610.5b01ab7e",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8040020231123154610.5b01ab7e",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8040020231123154610.5b01ab7e",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8060020231208020207.ada582f1",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
},
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "0:1.18.2-16.el8_6",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "8080020231201153604.b0a6ceea",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 9",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "0:4.10.2-5.el9_3",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "0:4.9.8-9.el9_0",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"versions": [
|
|
{
|
|
"version": "0:4.10.1-10.el9_2",
|
|
"lessThan": "*",
|
|
"versionType": "rpm",
|
|
"status": "unaffected"
|
|
}
|
|
],
|
|
"defaultStatus": "affected"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "Red Hat Enterprise Linux 6",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_value": "not down converted",
|
|
"x_cve_json_5_version_data": {
|
|
"defaultStatus": "unknown"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0137",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0137"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0138",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0138"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0139",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0139"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0140",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0140"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0141",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0141"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0142",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0142"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0143",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0143"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0144",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0144"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0145",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0145"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/errata/RHSA-2024:0252",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/errata/RHSA-2024:0252"
|
|
},
|
|
{
|
|
"url": "https://access.redhat.com/security/cve/CVE-2023-5455",
|
|
"refsource": "MISC",
|
|
"name": "https://access.redhat.com/security/cve/CVE-2023-5455"
|
|
},
|
|
{
|
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242828",
|
|
"refsource": "MISC",
|
|
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=2242828"
|
|
},
|
|
{
|
|
"url": "https://www.freeipa.org/release-notes/4-10-3.html",
|
|
"refsource": "MISC",
|
|
"name": "https://www.freeipa.org/release-notes/4-10-3.html"
|
|
},
|
|
{
|
|
"url": "https://www.freeipa.org/release-notes/4-11-1.html",
|
|
"refsource": "MISC",
|
|
"name": "https://www.freeipa.org/release-notes/4-11-1.html"
|
|
},
|
|
{
|
|
"url": "https://www.freeipa.org/release-notes/4-6-10.html",
|
|
"refsource": "MISC",
|
|
"name": "https://www.freeipa.org/release-notes/4-6-10.html"
|
|
},
|
|
{
|
|
"url": "https://www.freeipa.org/release-notes/4-9-14.html",
|
|
"refsource": "MISC",
|
|
"name": "https://www.freeipa.org/release-notes/4-9-14.html"
|
|
}
|
|
]
|
|
},
|
|
"work_around": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."
|
|
}
|
|
],
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 6.5,
|
|
"baseSeverity": "MEDIUM",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "REQUIRED",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |