Information disclosure in Freeipa
CVE-2017-12169
It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.
Vulnerability class: Information Disclosure
EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Freeipa
- Freeipa Ipa — versions 4.2.0 and later
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2017-12169?
- CVE-2017-12169 is a high-severity vulnerability in Freeipa, classified under Information Disclosure. CVSS score: 7.5/10. Published 2018-01-10.
- How severe is CVE-2017-12169?
- High severity. CVSS v3 base score is 7.5 out of 10.