CVE-2017-11191

FreeIPA 2.213 Session Hijacking

Severity Score

8.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and does not recognize this report as a valid security concern

** EN DISPUTA ** Las versiones 4.x de FreeIPA que tengan la versión 2.213 de la API permiten que usuarios autenticados remotos omitan las restricciones de bloqueo de cuenta previstas mediante una acción de desbloqueo con un ID de sesión antiguo (para la misma cuenta de usuario) que se había creado para una sesión anterior. NOTA: El fabricante afirma que no existe este problema en este producto y no reconoce este informe como un problema de seguridad válido.

FreeIPA version 2.213 suffers from a session hijacking vulnerability.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2017-07-12 CVE Reserved
2017-07-27 CVE Published
2023-11-23 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-384: Session Fixation

CAPEC

References (1)

URL	Tag	Source
http://packetstormsecurity.com/files/143532/FreeIPA-2.213-Session-Hijacking.html	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.0.0 Search vendor "Freeipa" for product "Freeipa" and version "4.0.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.0.1 Search vendor "Freeipa" for product "Freeipa" and version "4.0.1"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.0.2 Search vendor "Freeipa" for product "Freeipa" and version "4.0.2"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.0.3 Search vendor "Freeipa" for product "Freeipa" and version "4.0.3"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.0.4 Search vendor "Freeipa" for product "Freeipa" and version "4.0.4"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.0.5 Search vendor "Freeipa" for product "Freeipa" and version "4.0.5"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.1.0 Search vendor "Freeipa" for product "Freeipa" and version "4.1.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.1.1 Search vendor "Freeipa" for product "Freeipa" and version "4.1.1"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.1.2 Search vendor "Freeipa" for product "Freeipa" and version "4.1.2"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.1.3 Search vendor "Freeipa" for product "Freeipa" and version "4.1.3"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.1.4 Search vendor "Freeipa" for product "Freeipa" and version "4.1.4"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.2.0 Search vendor "Freeipa" for product "Freeipa" and version "4.2.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.2.1 Search vendor "Freeipa" for product "Freeipa" and version "4.2.1"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.2.2 Search vendor "Freeipa" for product "Freeipa" and version "4.2.2"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.2.3 Search vendor "Freeipa" for product "Freeipa" and version "4.2.3"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.2.4 Search vendor "Freeipa" for product "Freeipa" and version "4.2.4"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.3.0 Search vendor "Freeipa" for product "Freeipa" and version "4.3.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.3.1 Search vendor "Freeipa" for product "Freeipa" and version "4.3.1"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.3.2 Search vendor "Freeipa" for product "Freeipa" and version "4.3.2"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.3.3 Search vendor "Freeipa" for product "Freeipa" and version "4.3.3"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.4.0 Search vendor "Freeipa" for product "Freeipa" and version "4.4.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.4.1 Search vendor "Freeipa" for product "Freeipa" and version "4.4.1"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.4.2 Search vendor "Freeipa" for product "Freeipa" and version "4.4.2"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.4.3 Search vendor "Freeipa" for product "Freeipa" and version "4.4.3"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.4.4 Search vendor "Freeipa" for product "Freeipa" and version "4.4.4"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.5.0 Search vendor "Freeipa" for product "Freeipa" and version "4.5.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.5.1 Search vendor "Freeipa" for product "Freeipa" and version "4.5.1"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.5.2 Search vendor "Freeipa" for product "Freeipa" and version "4.5.2"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.5.3 Search vendor "Freeipa" for product "Freeipa" and version "4.5.3"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.6.0 Search vendor "Freeipa" for product "Freeipa" and version "4.6.0"		-		Affected
Freeipa Search vendor "Freeipa"		Freeipa Search vendor "Freeipa" for product "Freeipa"				4.6.1 Search vendor "Freeipa" for product "Freeipa" and version "4.6.1"		-		Affected