CVE search · CVE-2012-5631

CVE-2012-5631

high 8.8

ipa 3.0 does not properly check server identity before sending credential containing cookies

Open in the NVD CVE.org JSON

Status: Modified
Published: 2019-11-25
Last changed: 2026-06-16
Source: secalert@redhat.com
Weakness: CWE-565

Severity

Version	Score	Vector	Source
CVSS 3.1	high 8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`	nvd@nist.govPrimary
CVSS 2.0	medium 6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`	nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

freeipa · freeipa

References

http://www.securityfocus.com/bid/56919Third Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/cve-2012-5631Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5631Issue TrackingThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/80784Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/56919Third Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/cve-2012-5631Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5631Issue TrackingThird Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/80784Third Party AdvisoryVDB Entry