Skip to main content

Freeipa CVE-2016-5414

HIGH
Improper Access Control (CWE-284)
2017-06-27 secalert@redhat.com
Authentication Bypass Freeipa
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 27, 2017 - 20:29 cve.org
HIGH 7.5

DescriptionCVE.org

FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.

AnalysisAI

FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-284. FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. Affected products include: Freeipa.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Freeipa

View all
CVE-2015-5179 HIGH POC
7.5 Sep 20

FreeIPA might display user data improperly via vectors involving non-printable characters. Rated high severity (CVSS 7.5
CVE-2015-5284 CRITICAL
9.8 Sep 21

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem,
CVE-2013-0336 MEDIUM POC
5.0 Nov 03

The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) i
CVE-2017-11191 HIGH
8.8 Sep 28

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions v
CVE-2024-2698 HIGH
8.8 Jun 12

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition
CVE-2019-14867 HIGH
8.8 Nov 27

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before

CVE-2012-5484 HIGH
7.9 Jan 27

The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate fro
CVE-2016-7030 HIGH
7.5 Aug 28

FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows

CVE-2016-5404 MEDIUM
6.5 Sep 07

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authentic
CVE-2023-5455 MEDIUM
6.5 Jan 10

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA.
CVE-2019-10195 MEDIUM
6.5 Nov 27

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before

CVE-2020-1722 MEDIUM
5.3 Apr 27

A flaw was found in all ipa versions 4.x.x through 4.8.0. Rated medium severity (CVSS 5.3), this vulnerability is remote

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2016-5414 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy