Red Hat Freeipa vulnerabilities

5 CVEs affecting Red Hat Freeipa, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-0336, published 2014-11-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-0336, published 2014-11-03. Medium severity, CVSS 5.0. EPSS: 2.8% chance of exploitation in the next 30 days. The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service…
CVE-2013-0199, published 2014-05-29. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the…
CVE-2008-3274, published 2008-09-12. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the…
CVE-2011-3636, published 2011-12-08. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make…
CVE-2012-5484, published 2013-01-27. High severity, CVSS 7.9. EPSS: 0.6% chance of exploitation in the next 30 days. The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join…