CVE ID:	CVE-2023-5455
Description:	A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
Test IDs:	1.3.6.1.4.1.25623.1.1.9.2024.49781004971011009998   1.3.6.1.4.1.25623.1.0.884330   1.3.6.1.4.1.25623.1.0.885620   1.3.6.1.4.1.25623.1.0.885617
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2023-5455 RHBZ#2242828 https://bugzilla.redhat.com/show_bug.cgi?id=2242828 RHSA-2024:0137 https://access.redhat.com/errata/RHSA-2024:0137 RHSA-2024:0138 https://access.redhat.com/errata/RHSA-2024:0138 RHSA-2024:0139 https://access.redhat.com/errata/RHSA-2024:0139 RHSA-2024:0140 https://access.redhat.com/errata/RHSA-2024:0140 RHSA-2024:0141 https://access.redhat.com/errata/RHSA-2024:0141 RHSA-2024:0142 https://access.redhat.com/errata/RHSA-2024:0142 RHSA-2024:0143 https://access.redhat.com/errata/RHSA-2024:0143 RHSA-2024:0144 https://access.redhat.com/errata/RHSA-2024:0144 RHSA-2024:0145 https://access.redhat.com/errata/RHSA-2024:0145 RHSA-2024:0252 https://access.redhat.com/errata/RHSA-2024:0252 https://access.redhat.com/security/cve/CVE-2023-5455 https://access.redhat.com/security/cve/CVE-2023-5455 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U76DAZZVY7V4XQBOOV5ETPTHW3A6MW5O/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U76DAZZVY7V4XQBOOV5ETPTHW3A6MW5O/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFNUQH7IOHTKCTKQWFHONWGUBOUANL6I/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFNUQH7IOHTKCTKQWFHONWGUBOUANL6I/ https://www.freeipa.org/release-notes/4-10-3.html https://www.freeipa.org/release-notes/4-10-3.html https://www.freeipa.org/release-notes/4-11-1.html https://www.freeipa.org/release-notes/4-11-1.html https://www.freeipa.org/release-notes/4-6-10.html https://www.freeipa.org/release-notes/4-6-10.html https://www.freeipa.org/release-notes/4-9-14.html https://www.freeipa.org/release-notes/4-9-14.html