{"id":"CVE-2017-12169","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-12169","generatedAt":"2026-10-28T19:05:58.868Z","title":"It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission.","description":"It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to Stage Users. This security issue does not result in disclosure of password hashes belonging to active standard users. NOTE: some developers feel that this report is a suggestion for a design change to Stage User activation, not a statement of a vulnerability.","published":"2018-01-10T15:29:00.000Z","lastModified":"2026-06-17T01:02:50.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.0","score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-200"],"affected":["freeipa/freeipa"],"epss":{"score":0.01925,"percentile":0.79838,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/102136","tags":["Third Party Advisory","VDB Entry"],"source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487697","tags":["Issue Tracking","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/102136","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487697","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-12169","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}