CVE-2023-5455— Red Hat FreeIPA 安全漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2023-5455の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Ipa: invalid csrf protection
ソース: NVD (National Vulnerability Database)
脆弱性説明
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
跨站请求伪造(CSRF)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Red Hat FreeIPA 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Red Hat FreeIPA是一个综合安全信息管理解决方案。 Red Hat FreeIPA 存在安全漏洞。攻击者利用该漏洞诱骗用户提交可以以用户身份执行操作的请求，从而导致机密性和系统完整性丢失。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 7 | 0:4.6.8-5.el7_9.16 ~ * | cpe:/o:redhat:enterprise_linux:7::server | |
| Red Hat | Red Hat Enterprise Linux 8 | 8090020231201152514.3387e3d0 ~ * | cpe:/a:redhat:enterprise_linux:8::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | 8020020231123154806.792f4060 ~ * | cpe:/a:redhat:rhel_aus:8.2::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | 8020020231123154806.792f4060 ~ * | cpe:/a:redhat:rhel_aus:8.2::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | 8020020231123154806.792f4060 ~ * | cpe:/a:redhat:rhel_aus:8.2::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 8040020231123154610.5b01ab7e ~ * | cpe:/a:redhat:rhel_aus:8.4::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | 8040020231123154610.5b01ab7e ~ * | cpe:/a:redhat:rhel_aus:8.4::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | 8040020231123154610.5b01ab7e ~ * | cpe:/a:redhat:rhel_aus:8.4::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | 8060020231208020207.ada582f1 ~ * | cpe:/a:redhat:rhel_eus:8.6::appstream | |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | 8080020231201153604.b0a6ceea ~ * | cpe:/a:redhat:rhel_eus:8.8::appstream | |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.10.2-5.el9_3 ~ * | cpe:/a:redhat:enterprise_linux:9::crb | |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | 0:4.9.8-9.el9_0 ~ * | cpe:/a:redhat:rhel_eus:9.0::appstream | |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | 0:4.10.1-10.el9_2 ~ * | cpe:/a:redhat:rhel_eus:9.2::appstream | |
| Red Hat | Red Hat Enterprise Linux 6 | - | cpe:/o:redhat:enterprise_linux:6 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 |
II. CVE-2023-5455の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2023-5455のインテリジェンス情報
请登录查看更多情报信息。
IV. 関連脆弱性
- CVE-2026-2239
Gimp: gimp: application crash (dos) via crafted psd file due - CVE-2023-40551
Shim: out of bounds read when parsing mz binaries - CVE-2023-40549
Shim: out-of-bounds read in verify_buffer_authenticode() mal - CVE-2023-40546
Shim: out-of-bounds read printing error messages - CVE-2023-40550
Shim: out-of-bound read in verify_buffer_sbat()
同じベンダー: Red Hat
- CVE-2026-42011
Gnutls: gnutls: security bypass due to incorrect name constr - CVE-2026-42010
Gnutls: gnutls: authentication bypass via nul character in u - CVE-2026-6420
Keylime: keylime: security bypass due to hardcoded tpm quote - CVE-2026-34956
Openvswitch: open vswitch: denial of service via malformed f - CVE-2026-34002
Xorg: xwayland: x.org x server: information disclosure or de
同じ弱点: CWE-352
- CVE-2021-47953
OpenCart 3.0.3.7 Cross-Site Request Forgery via account/pass - CVE-2021-47946
OpenCart 3.0.36 Account Takeover via Cross Site Request Forg - CVE-2022-50955
WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery - CVE-2026-8194
osTicket Dispatcher class.dispatcher.php cross-site request - CVE-2026-42286
Emlog: Cross-Site Request Forgery in Admin Functions
V. CVE-2023-5455へのコメント
まだコメントはありません