FR
Product
Freeipa
25
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 14Medium 7Low 0
Watch
Add Freeipa to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5284 | 9.8 | Sep 21 | ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable Affected: through 4.2.1 |
| CVE-2024-2698 | 8.8 | Jun 12 | Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service Affected: 4.11.0 before 4.11.2; 4.12.0 |
| CVE-2019-14867 | 8.8 | Nov 27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was… Affected: 4.6.0 before 4.6.7; 4.7.0 before 4.7.4; 4.8.0 before 4.8.3 |
| CVE-2012-5631 | 8.8 | Nov 25 | ipa 3.0 does not properly check server identity before sending credential containing cookies Affected: 3.0.0 |
| CVE-2017-11191 | 8.8 | Sep 28 | FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +25 more |
| CVE-2026-13097 | 8.7 | Aug 20 | Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore Affected: 4.12.2 |
| CVE-2026-19550 | 8.2 | Aug 11 | Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes Affected: before 4.13.3 |
| CVE-2026-11861 | 8.1 | Aug 20 | Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships Affected: before 4.13.3 |
| CVE-2017-2590 | 8.1 | Jul 27 | A vulnerability was found in ipa before 4.4 Affected: before 4.4.0 |
| CVE-2026-73198 | 7.5 | Aug 20 | Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read Affected: before 4.13.3 |
| CVE-2026-73197 | 7.5 | Aug 20 | Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read Affected: before 4.13.3 |
| CVE-2017-12169 | 7.5 | Jan 10 | It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission Affected: 4.2.0 and later |
| CVE-2015-5179 | 7.5 | Sep 20 | FreeIPA might display user data improperly via vectors involving non-printable characters Affected: through 4.5.0 |
| CVE-2016-7030 | 7.5 | Aug 28 | FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking… Affected: 4.6.0 |
| CVE-2016-5414 | 7.5 | Jun 27 | FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services Affected: 4.4.0 |
| CVE-2026-73196 | 6.5 | Aug 20 | Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding Affected: before 4.13.3 |
| CVE-2023-5455 | 6.5 | Jan 10 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA Affected: before 4.6.10; 4.7.0 before 4.9.14; 4.10.0 before 4.10.3; 4.11.0; 4.11.0 |
| CVE-2019-10195 | 6.5 | Nov 27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API… Affected: 4.6.0 before 4.6.7; 4.7.0 before 4.7.4; 4.8.0 before 4.8.3 |
| CVE-2016-5404 | 6.5 | Sep 7 | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging… Affected: All versions, or not specified |
| CVE-2016-9575 | 6.3 | Mar 13 | Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command Affected: 4.2.0; 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; +6 more |
| CVE-2020-1722 | 5.3 | Apr 27 | A flaw was found in all ipa versions 4.x.x through 4.8.0 Affected: 4.0.0 through 4.8.0 |
| CVE-2019-14826 | 4.4 | Sep 17 | A flaw was found in FreeIPA versions 4.5.0 and later Affected: 4.5.0 and later |
| CVE-2015-1827 | – | Mar 30 | The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to… Affected: through 4.1.3 |
| CVE-2014-7850 | – | Nov 28 | Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +2 more |
| CVE-2014-7828 | – | Nov 19 | FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.1 |
Showing 25