---
id: CVE-2023-5455
title: 'Ipa: invalid csrf protection'
summary: >-
  A Cross-site request forgery vulnerability exists in
  ipa/session/login_password in all supported versions of IPA. This flaw allows
  an attacker to trick the user into submitting a request that could perform
  actions as the user, resulting …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-352
vendor: Red Hat
product: ipa
affected:
  - ipa (all versions)
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - 'idm:DL1 (all versions)'
  - ipa (all versions)
  - ipa (all versions)
  - ipa (all versions)
  - ipa
  - 'idm:client/ipa'
  - krb5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-01-23T16:16:21.894068Z'
published: '2024-01-10'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T11:35:48.603Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-5455'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:0137'
    label: 'RHSA-2024:0137'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0138'
    label: 'RHSA-2024:0138'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0139'
    label: 'RHSA-2024:0139'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0140'
    label: 'RHSA-2024:0140'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0141'
    label: 'RHSA-2024:0141'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0142'
    label: 'RHSA-2024:0142'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0143'
    label: 'RHSA-2024:0143'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0144'
    label: 'RHSA-2024:0144'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0145'
    label: 'RHSA-2024:0145'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-5455'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2242828'
    label: RHBZ#2242828
  - url: 'https://www.freeipa.org/release-notes/4-10-3.html'
  - url: 'https://www.freeipa.org/release-notes/4-11-1.html'
  - url: 'https://www.freeipa.org/release-notes/4-6-10.html'
  - url: 'https://www.freeipa.org/release-notes/4-9-14.html'
tags:
  - cve.org
epss: 0.00574
epssPercentile: 0.47539
ingestedAt: '2026-11-05T21:36:00.804Z'
---

## Overview

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

## Affected

- `ipa (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `idm:DL1 (all versions)`
- `ipa (all versions)`
- `ipa (all versions)`
- `ipa (all versions)`
- `ipa`
- `idm:client/ipa`
- `krb5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.