CVE-2024-26988.8HighCWE-863

CVE-2024-2698: Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

Redhat · freeipa

Vendor fix available · Affected: Redhat freeipa · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.7%probability of exploitation in the next 30 days

52nd percentile

050100

Higher than 52% of scored CVEs

8.8HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.

Affected products8

From the CVE record. A product or version that is not listed is unknown, not unaffected.

freeipafrom 4.11.0 before 4.11.2; from 4.12.0 before 4.12.1
Red Hat · Red Hat Enterprise Linux 8Versions not stated
Red Hat · Red Hat Enterprise Linux 8.8 Extended Update SupportVersions not stated
Red Hat · Red Hat Enterprise Linux 9Versions not stated
Red Hat · Red Hat Enterprise Linux 9.2 Extended Update SupportVersions not stated
Red Hat · Red Hat Enterprise Linux 6Versions not stated
Red Hat · Red Hat Enterprise Linux 7Versions not stated
Red Hat · Red Hat Enterprise Linux 8Versions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Incorrect Authorization · Access Control
Vendor: Redhat
Published: June 2024
Band: Unlikely (under 1%), June 2024

CoverageNo articles yet

No CyberSIXT article names CVE-2024-2698 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.