Is CVE-2023-5455 in the CISA KEV catalog?

No. CVE-2023-5455 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2023-5455?

CVE-2023-5455 has a CVSS v3 base score of 6.5 (MEDIUM).

What is the EPSS score for CVE-2023-5455?

CVE-2023-5455 has an EPSS score of 0.57% (43th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2023-5455?

Upgrade freeipa on debian 13 to 4.11.1-1 or later. Fixes are available for 109 affected products.

CVE & CISA-KEV Catalog

CVE-2023-5455

MEDIUM

6.5

CVSS v3

NVD

Description

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CWE-352Cross-Site Request Forgery

How to fix

Remediation Available

freeipaDebian

Fixed in:4.11.1-1CVE-2023-5455

bind-dyndb-ldapRed Hat / RHEL

Fixed in:0:11.6-2.module+el8.4.0+9328+4ec4e316.x86_64::idm:DL1RHSA-2024:0138

Fixed in:0:11.6-4.module+el8.8.0+17351+9a3fb056.s390x::idm:DL1RHSA-2024:0137

Fixed in:0:11.6-4.module+el8.9.0+18911+94941f82.x86_64::idm:DL1RHSA-2024:0143

Fixed in:0:11.6-4.module+el8.9.0+18911+94941f82.aarch64::idm:DL1RHSA-2024:0143

Fixed in:0:11.6-2.module+el8.4.0+9328+4ec4e316.aarch64::idm:DL1RHSA-2024:0138

Fixed in:0:11.6-4.module+el8.6.0+16878+6c033536.x86_64::idm:DL1RHSA-2024:0139

Fixed in:0:11.6-4.module+el8.8.0+17351+9a3fb056.ppc64le::idm:DL1RHSA-2024:0137

Fixed in:0:11.6-4.module+el8.9.0+18911+94941f82.ppc64le::idm:DL1RHSA-2024:0143

Fixed in:0:11.6-4.module+el8.9.0+18911+94941f82.s390x::idm:DL1RHSA-2024:0143

Fixed in:0:11.6-4.module+el8.6.0+16878+6c033536.s390x::idm:DL1RHSA-2024:0139

Fixed in:0:11.6-4.module+el8.8.0+17351+9a3fb056.x86_64::idm:DL1RHSA-2024:0137

Fixed in:0:11.6-4.module+el8.6.0+16878+6c033536.ppc64le::idm:DL1RHSA-2024:0139

Fixed in:0:11.6-4.module+el8.6.0+16878+6c033536.aarch64::idm:DL1RHSA-2024:0139

Fixed in:0:11.6-4.module+el8.8.0+17351+9a3fb056.src::idm:DL1RHSA-2024:0137

Fixed in:0:11.6-4.module+el8.6.0+16878+6c033536.src::idm:DL1RHSA-2024:0139

Fixed in:0:11.2-3.module+el8.2.0+4921+923e30d5.ppc64le::idm:DL1RHSA-2024:0144

Fixed in:0:11.6-2.module+el8.4.0+9328+4ec4e316.src::idm:DL1RHSA-2024:0138

Fixed in:0:11.6-2.module+el8.4.0+9328+4ec4e316.s390x::idm:DL1RHSA-2024:0138

Fixed in:0:11.2-3.module+el8.2.0+4921+923e30d5.x86_64::idm:DL1RHSA-2024:0144

Fixed in:0:11.6-2.module+el8.4.0+9328+4ec4e316.ppc64le::idm:DL1RHSA-2024:0138

Fixed in:0:11.6-4.module+el8.8.0+17351+9a3fb056.aarch64::idm:DL1RHSA-2024:0137

Fixed in:0:11.2-3.module+el8.2.0+4921+923e30d5.src::idm:DL1RHSA-2024:0144

Fixed in:0:11.6-4.module+el8.9.0+18911+94941f82.src::idm:DL1RHSA-2024:0143

bind-dyndb-ldapRocky