CVE-2016-5404

Summary

CVE	CVE-2016-5404
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2016-09-07 20:59:01 UTC
Updated	2026-05-06 22:30:45 UTC
Description	The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

Risk And Classification

Primary CVSS: v3.0 6.5 MEDIUM from [email protected]

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.004670000 probability, percentile 0.645520000 (date 2026-05-12)

Problem Types: CWE-284 | n/a

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	6.5	MEDIUM	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
2.0	[email protected]	Primary	4		`AV:N/AC:L/Au:S/C:N/I:N/A:P`

CVSS v3.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

None

Availability

Partial

AV:N/AC:L/Au:S/C:N/I:N/A:P

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Fedoraproject	Fedora	23	All	All	All
Operating System	Fedoraproject	Fedora	24	All	All	All
Operating System	Fedoraproject	Fedora	25	All	All	All
Application	Freeipa	Freeipa	-	All	All	All
Operating System	Oracle	Linux	6	All	All	All
Operating System	Oracle	Linux	7	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
[SECURITY] Fedora 25 Update: freeipa-4.3.2-2.fc25 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
oss-security - CVE-2016-5404 freeipa: Insufficient privileges check in certificate revocation	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Third Party Advisory
Oracle Linux Bulletin - July 2016	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Third Party Advisory
#6232 (Insufficient privileges check in certificate revocation (CVE-2016-5404)) – freeipa	af854a3a-2127-422b-91ae-364da2661108	fedorahosted.org	Issue Tracking
FreeIPA CVE-2016-5404 Denial of Service Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
freeipa.git - FreeIPA git repository, for more info see http://freeipa.org	af854a3a-2127-422b-91ae-364da2661108	git.fedorahosted.org	Issue Tracking, Patch
[SECURITY] Fedora 24 Update: freeipa-4.3.2-2.fc24 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
Red Hat Customer Portal	af854a3a-2127-422b-91ae-364da2661108	rhn.redhat.com
[SECURITY] Fedora 23 Update: freeipa-4.2.4-2.fc23 - package-announce - Fedora Mailing-Lists	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
[SECURITY] Fedora 23 Update: freeipa-4.2.4-2.fc23 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
[SECURITY] Fedora 24 Update: freeipa-4.3.2-2.fc24 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
[SECURITY] Fedora 25 Update: freeipa-4.3.2-2.fc25 - package-announce - Fedora Mailing-Lists	MITRE	lists.fedoraproject.org
Red Hat Customer Portal	MITRE	access.redhat.com
CVE-2016-5404 - Red Hat Customer Portal	MITRE	access.redhat.com
1351593 – (CVE-2016-5404) CVE-2016-5404 ipa: Insufficient privileges check in certificate revocation	MITRE	bugzilla.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.