PT-2018-5377 · Red Hat+1 · Freeipa+1

Adam Mariš · Publicado 2017-01-09 · Atualizado 2018-04-17 · CVE-2017-12169

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.2.0 and later

Description A security issue was discovered where FreeIPA could disclose password hashes to users with the System: Read Stage Users permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This issue does not result in the disclosure of password hashes belonging to active standard users.

Recommendations For FreeIPA versions 4.2.0 and later, consider restricting the System: Read Stage Users permission to minimize the risk of exploitation. As a temporary workaround, consider disabling the Stage User activation feature until a design change or patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2025-05018

CVE-2017-12169

Produtos afetados

Debian

Freeipa

Referências · 11

• https://cve.org/CVERecord?id=CVE-2017-12169 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12169 · Aviso do Fabricante
• http://securityfocus.com/bid/102136 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1487697 · Nota
• https://osv.dev/vulnerability/CVE-2017-12169 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-05018 · Nota de Segurança
• https://clouddefense.ai/cve/2017/CVE-2017-12169 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12169 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-12169 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-12169 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12169 · Aviso do Fabricante