Known vulnerabilities in FreeIPA

Software: FreeIPA
Software CPE: cpe:2.3:a:freeipa_org:freeipa:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 20
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FreeIPA FreeIPA is affected by 20 known vulnerabilities: 4 high, 11 medium, 5 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU116216 - Insufficient Granularity of Access Control
CVE-2025-7493
CWE-1220 Medium
No
No
4.12.5 01.10.2025 SB2025100120
SB2025100123
SB2025100124
and 14 more
#VU112054 - Improper input validation
CVE-2025-4404
CWE-20 Medium
Available
No
4.12.4 30.06.2025 SB2025063081
SB2025063085
SB2025063086
and 14 more
#VU103304 - Information Exposure Through Log Files
CVE-2024-11029
CWE-532 Low
No
No
4.12.3 24.01.2025 SB2025012493
SB2025012494
SB2025012496
and 1 more
#VU92249 - Use of Password Hash With Insufficient Computational Effort
CVE-2024-3183
CWE-916 Low
Available
No
4.11.2, 4.12.1 19.06.2024 SB2024061917
SB2024061918
SB2024061919
and 11 more
#VU92247 - Improper Authorization
CVE-2024-2698
CWE-285 Medium
No
No
4.11.2, 4.12.1 19.06.2024 SB2024061917
SB2024061919
SB2024061920
and 5 more
#VU87167 - Improper input validation
CVE-2024-1481
CWE-20 Medium
No
No
- 06.03.2024 SB2024030645
SB2024030665
SB2024030666
and 5 more
#VU85268 - Cross-Site Request Forgery (CSRF)
CVE-2023-5455
CWE-352 Medium
No
No
4.6.10, 4.9.14, 4.10.3, 4.11.1 10.01.2024 SB2024011032
SB2024011039
SB2024011040
and 17 more
#VU47198 - Resource exhaustion
CVE-2020-1722
CWE-400 Medium
No
No
4.8.1 27.04.2020 SB2020042729
SB2020093090
SB2020110508
#VU26103 - Improper input validation
CVE-2019-14867
CWE-20 High
No
No
4.6.7, 4.7.4, 4.8.3 17.03.2020 SB2019112719
SB2019121718
SB2020040168
and 4 more
#VU26102 - Information Exposure Through Log Files
CVE-2019-10195
CWE-532 Low
No
No
4.6.7, 4.7.4, 4.8.3 17.03.2020 SB2019112719
SB2019121718
SB2020040168
and 4 more
#VU35041 - Reliance on Cookies without Validation and Integrity Checking
CVE-2012-5631
CWE-565 High
No
No
- 25.11.2019 SB2019112520
#VU36812 - Improper input validation
CVE-2017-2590
CWE-20 High
No
No
4.4.0 27.07.2018 SB2018072718
SB2017022711
SB2017030214
#VU37442 - Improper Authorization
CVE-2016-9575
CWE-285 Medium
No
No
- 13.03.2018 SB2018031342
SB2016121511
SB2016121512
and 3 more
#VU38415 - Credentials Management
CVE-2016-7030
CWE-255 Medium
No
No
- 28.08.2017 SB2017082811
SB2016121511
SB2016121512
and 3 more
#VU38806 - Improper Access Control
CVE-2016-5414
CWE-284 Medium
No
No
- 27.06.2017 SB2017062713
#VU41054 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2014-7850
CWE-79 Low
No
No
- 28.11.2014 SB2014111901
SB2014112102
#VU41092 - Permissions, Privileges, and Access Controls
CVE-2014-7828
CWE-264 Low
No
No
- 19.11.2014 SB2014111901
SB2014110603
#VU41176 - Improper input validation
CVE-2013-0336
CWE-20 Medium
No
No
- 04.11.2014 SB2014110405
#VU41602 - Permissions, Privileges, and Access Controls
CVE-2013-0199
CWE-264 Medium
No
No
- 29.05.2014 SB2014052901
#VU43149 - Cryptographic Issues
CVE-2012-5484
CWE-310 High
No
No
- 27.01.2013 SB2013012701