CVE-2023-5455

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

• CWE-352
• CWE-352

• https://access.redhat.com/errata/RHSA-2024:0137Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0138Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0139Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0140Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0141Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0142Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0143Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0144Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0145Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2023-5455Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2242828Issue Tracking, Third Party Advisory
• https://www.freeipa.org/release-notes/4-10-3.htmlRelease Notes
• https://www.freeipa.org/release-notes/4-11-1.htmlRelease Notes
• https://www.freeipa.org/release-notes/4-6-10.htmlRelease Notes
• https://www.freeipa.org/release-notes/4-9-14.htmlRelease Notes
• https://access.redhat.com/errata/RHSA-2024:0137Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0138Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0139Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0140Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0141Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0142Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0143Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0144Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0145Third Party Advisory
• https://access.redhat.com/errata/RHSA-2024:0252Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2023-5455Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2242828Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U76DAZZVY7V4XQBOOV5ETPTHW3A6MW5O/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFNUQH7IOHTKCTKQWFHONWGUBOUANL6I/
• https://www.freeipa.org/release-notes/4-10-3.htmlRelease Notes
• https://www.freeipa.org/release-notes/4-11-1.htmlRelease Notes
• https://www.freeipa.org/release-notes/4-6-10.htmlRelease Notes
• https://www.freeipa.org/release-notes/4-9-14.htmlRelease Notes

Published

Jan 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5448The WP Register Profile With Shortcode plugin for WordPress …8.8
• CVE-2023-5449A potential security vulnerability has been identified in ce…3.3
• CVE-2023-5450 An insufficient verification of data vulnerability exists i…7.8
• CVE-2023-5451Forcepoint NGFW Security Management Center Management Serve…6.1
• CVE-2023-5452Cross-site Scripting (XSS) - Stored in GitHub repository sni…5.4
• CVE-2023-5454The Templately WordPress plugin before 2.2.6 does not proper…7.5
• CVE-2023-5456A CWE-798 “Use of Hard-coded Credentials” vulnerability in t…9.8
• CVE-2023-5457A CWE-1269 “Product Released in Non-Release Configuration” v…9.8
• CVE-2023-5458The CITS Support svg, webp Media and TTF,OTF File Upload Wor…5.4
• CVE-2023-5459A vulnerability has been found in Delta Electronics DVP32ES2…7.5
• CVE-2023-5460A vulnerability was found in Delta Electronics WPLSoft up to…5.7
• CVE-2023-5461A vulnerability was found in Delta Electronics WPLSoft 2.51.…5.9