9.1 CVE-2025-7493

Enriched by CISA
 

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
https://nvd.nist.gov/vuln/detail/CVE-2025-7493

Categories

CWE-1220 : Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms An operating system has an overly permission Access Control List onsome system files, including those related to user passwords

References


 

AFFECTED (from MITRE)

Vendor Product Versions
Red Hat Red Hat Enterprise Linux 10
  • 0:4.12.2-15.el10_0.4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • 0:4.6.8-5.el7_9.23 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8
  • 8100020250919180242.143e9e98 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8
  • 8100020250918211722.823393f5 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • 8020020250924110056.50ea30f9 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • 8020020250924104944.792f4060 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • 8040020250923180004.f153676a < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • 8040020250923175408.5b01ab7e < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • 8040020250923180004.f153676a < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • 8040020250923175408.5b01ab7e < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • 8060020250916172436.c1533a64 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • 8060020250916174421.ada582f1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • 8060020250916172436.c1533a64 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • 8060020250916174421.ada582f1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • 8060020250916172436.c1533a64 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • 8060020250916174421.ada582f1 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • 8080020250918184739.e581a9e4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • 8080020250918152850.b0a6ceea < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • 8080020250918184739.e581a9e4 < * [unaffected]
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • 8080020250918152850.b0a6ceea < * [unaffected]
Red Hat Red Hat Enterprise Linux 9
  • 0:4.12.2-14.el9_6.5 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • 0:4.9.8-11.el9_0.5 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • 0:4.10.1-12.el9_2.6 < * [unaffected]
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • 0:4.11.0-15.el9_4.7 < * [unaffected]
Red Hat Red Hat Enterprise Linux 6
    © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

    CPE

    cpe start end

    REMEDIATION


    EXPLOITS

    Exploit-db.com

    id description date
    No known exploits

    POC Github

    Url
    No known exploits

    Other Nist (github, ...)

    Url
    No known exploits

    CAPEC

    Common Attack Pattern Enumerations and Classifications

    id description severity
    1 Accessing Functionality Not Properly Constrained by ACLs
    		High
    180 Exploiting Incorrectly Configured Access Control Security Levels
    		Medium

    MITRE

    Techniques

    id description
    T1574.010 Hijack Execution Flow: ServicesFile Permissions Weakness
    © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

    Mitigations

    id description
    M1018 Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.
    © 2022 The MITRE Corporation. Esta obra se reproduce y distribuye con el permiso de The MITRE Corporation.