CVE-2016-5404

Low

Low Medium High Critical

CVSS Score

Published: Sep 07, 2016

Last Modified: Apr 12, 2025

Vulnerability Description

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

Known Affected Software

6 configuration(s) from 3 vendor(s)

fedora

Version:

CPE:

cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*

fedora

Version:

CPE:

cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

fedora

Version:

CPE:

cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*

freeipa

Version:

CPE:

cpe:2.3:a:freeipa:freeipa:-:*:*:*:*:*:*:*

linux

Version:

CPE:

cpe:2.3:o:oracle:linux:7:8:*:*:*:*:*:*

linux

Version:

CPE:

cpe:2.3:o:oracle:linux:6:10:*:*:*:*:*:*

This vulnerability affects 6 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-284

Improper Access Control

Description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Typical Severity: Medium
Abstraction Level: Pillar