CVE-2017-12169
Last modified
CVE-2017-12169 is a vulnerability of currently unknown severity. It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. EPSS estimates a 1.93% chance of exploitation in the next 30 days.
Description
It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freeipa | Freeipa | >= 4.2.0 |
References
- http://www.securityfocus.com/bid/102136Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1487697Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/102136Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1487697Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-12169?
How severe is CVE-2017-12169?
How do I fix CVE-2017-12169?
Are you affected by CVE-2017-12169?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST