CVE-2017-12169

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-10 · updated 2026-06-17
Weakness: CWE-200

Description

It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.

Affected products

FreeIPA ipa: from 4.2.0

References

http://www.securityfocus.com/bid/102136
https://bugzilla.redhat.com/show_bug.cgi?id=1487697
http://www.securityfocus.com/bid/102136
https://bugzilla.redhat.com/show_bug.cgi?id=1487697

Get alerted when CVE-2017-12169 or the next vulnerability affects your stack