CVE Vulnerabilities

CVE-2012-5631

Reliance on Cookies without Validation and Integrity Checking

Published: Nov 25, 2019 | Modified: Dec 09, 2019
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
4.3 MODERATE
AV:A/AC:M/Au:N/C:P/I:P/A:N
RedHat/V3
Ubuntu

ipa 3.0 does not properly check server identity before sending credential containing cookies

Weakness

The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Affected Software

Name Vendor Start Version End Version
Freeipa Freeipa 3.0.0 3.0.0
Freeipa Ubuntu upstream *

Potential Mitigations

References