{"schema_version":"1.9.0","id":"CVE-2023-5455","published":"2024-01-10T12:33:00.336Z","modified":"2026-08-12T03:51:44.158602950Z","related":["ALSA-2024:0141","ALSA-2024:0143"],"summary":"Ipa: invalid csrf protection","details":"A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freeipa/freeipa","events":[{"introduced":"0"},{"fixed":"9c617675d6676fcdb0e9d67fed6bb801e0066bfe"},{"introduced":"f84b3f39edb880183722f4814acc56ae1f8edba7"},{"fixed":"deec13573d02c9e7eabd19201b7adb1e1eccd7e3"},{"introduced":"082ec006f43883540eca48d8190c3d6bf83c9405"},{"fixed":"74710a8ed24b4b8a14a07ca0642507d260039b30"},{"introduced":"63f5e576856d339a408c170461604f271cd03a5d"},{"last_affected":"63f5e576856d339a408c170461604f271cd03a5d"}],"database_specific":{"cpe":["cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:*","cpe:2.3:a:freeipa:freeipa:4.11.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"fixed":"4.6.10"},{"introduced":"4.7.0"},{"fixed":"4.9.14"},{"introduced":"4.10.0"},{"fixed":"4.10.3"},{"introduced":"4.11.0-NA"},{"last_affected":"4.11.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["4.11.0-NA","release-4-11-0","release-4-10-2","release-4-9-13","release-4-6-9","release-4-9-12","release-4-9-11","release-4-10-1","release-4-10-0","release-4-9-10","release-4-9-9","release-4-9-8","release-4-9-7","release-4-9-6","release-4-9-5","release-4-9-4","release-4-9-3","release-4-9-2","release-4-9-1","release-4-9-0","rc_4-9-0-3","rc_4-9-0-2","rc_4-9-0-1","release-4-6-8","release-4-6-6","release-4-8-0","rc_4-8-0-1","release-4-6-5","release-4-6-4","rc_4-7-0-2","rc_4-7-0-1","release-4-6-3","release-4-6-2","release-4-6-1","release-4-6-0","release-4-4-1","release-4-4-0","alpha_1-4-4-0","release-4-2-0","alpha_1-4-2-0","release-4-0-0","release-3-3-0","beta_2-3-3-0","beta_1-3-3-0","release-3-2-0","beta_1-3-2-0","release-3-2-0-pre1","release-3-1-0","beta_2-3-0-0","beta_1-3-0-0","release-2-1-0","release-2-0-0","rc_3-2-0-0","rc_2-2-0-0","rc_1-2-0-0","beta_1-2-0-0","alpha_5-1-9-0-1","alpha_5-1-9-0","alpha_4-1-9-0","alpha_3-1-9-0","alpha_2-1-9-0","alpha-1-9-0","release-1-1-0","release-1-0-0","milestone_6","milestone_4_1","milestone_4","milestone_3","milestone_2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-5455.json"}}],"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U76DAZZVY7V4XQBOOV5ETPTHW3A6MW5O/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFNUQH7IOHTKCTKQWFHONWGUBOUANL6I/"},{"type":"WEB","url":"https://www.freeipa.org/release-notes/4-10-3.html"},{"type":"WEB","url":"https://www.freeipa.org/release-notes/4-11-1.html"},{"type":"WEB","url":"https://www.freeipa.org/release-notes/4-6-10.html"},{"type":"WEB","url":"https://www.freeipa.org/release-notes/4-9-14.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0137"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0138"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0139"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0140"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0141"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0142"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0143"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0144"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0145"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0252"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-5455"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5455.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5455"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242828"}],"database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5455.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}