CVE-2024-1481

MediumCVSS 5.3/10Last modified Nov 5, 2026

Description

A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
—	—	4.10.1
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 7	—

References

Timeline

Published: Apr 10, 2024
Last modified: Nov 5, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-14826.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in publi CVE-2024-14837.5A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By craftin CVE-2024-14846.1The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date CVE-2024-14859.3A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks CVE-2024-14867.4Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices CVE-2024-14875.4The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users wi CVE-2024-14887.3A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbo CVE-2024-14894.3The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and CVE-2024-14907.2An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO CVE-2024-14917.5The devices allow access to an unprotected endpoint that allows MPFS file system binary image upload without authentication. The MPFS2 file CVE-2024-14925.3The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to CVE-2024-14936.5An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and s