Published: 10/01/2018 Updated: 17/04/2018

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freeipa freeipa

Debian Bug report logs - #895950 freeipa: CVE-2017-12169: Password hash disclosure via 'System: Read Stage Users' permission Package: src:freeipa; Maintainer for src:freeipa is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 17 Apr 2018 ...

It was found that IPA could disclose password hashes to users having the 'System: Read Stage Users' permission A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users This security issue does not result in disclosure of password hashes belonging to active standard users ...

CWE-200 https://bugzilla.redhat.com/show_bug.cgi?id=1487697 http://www.securityfocus.com/bid/102136 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=895950 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2017-12169

CVE-2017-12169

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect