PT-2017-11811 · Red Hat+1 · Freeipa+1

Published 2017-09-27 · Updated 2024-08-05 · CVE-2017-11191

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreeIPA versions 4.x

Description The issue allows a remote authenticated user to bypass intended account-locking restrictions via an unlock action with an old session ID for the same user account that had been created for an earlier session. The vendor states that the issue does not exist in the product and does not recognize this report as a valid security concern.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

ALT-PU-2018-1424

CVE-2017-11191

Affected Products

Alt Linux

Freeipa

References · 11

• https://osv.dev/vulnerability/CVE-2017-11191 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11191 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-11191 · Security Note
• https://errata.altlinux.org/ALT-PU-2018-1424 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11191 · Security Note
• https://ubuntu.com/security/CVE-2017-11191 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11191 · Vendor Advisory
• https://t.me/cvenotify/81993 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11191 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2017-11191 · Note
• http://packetstormsecurity.com/files/143532/FreeIPA-2.213-Session-Hijacking.html · Note