CVE-2019-14826
Published: 17 September 2019
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.
Notes
| Author | Note |
|---|---|
| msalvatore | Introduced in commit https://pagure.io/freeipa/c/b895f4a34bcbd0b1787d2bfc1db25f34c3584b9c |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
freeipa Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Ignored
(end of life)
|
|
| focal |
Needed
|
|
| groovy |
Ignored
(end of life)
|
|
| hirsute |
Ignored
(end of life)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Needed
|
|
| kinetic |
Ignored
(end of life, was needed)
|
|
| lunar |
Ignored
(end of life, was needed)
|
|
| mantic |
Needed
|
|
| trusty |
Not vulnerable
(vulnerable code not present)
|
|
| upstream |
Needed
|
|
| xenial |
Not vulnerable
(vulnerable code not present)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 4.4 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |