CVEs-PoC/2016/CVE-2016-5404.md

CVE-2016-5404

Description

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

POC

Reference

• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Github

No PoCs found on GitHub currently.