Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-10195

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.

Published

2019-11-27T08:15:10.617

Last Modified

2024-11-21T04:18:37.823

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-200
    CWE-532
  • Type: Primary
    CWE-532
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application freeipa freeipa < 4.6.7 Yes
Application freeipa freeipa < 4.7.4 Yes
Application freeipa freeipa < 4.8.3 Yes
Operating System fedoraproject fedora 30 Yes
Operating System fedoraproject fedora 31 Yes
References