CVE-2016-9575

CVE-2016-9575 describes an improper permission check vulnerability in FreeIPA versions 4.2.x, 4.3.x before 4.3.3, and 4.4.x before 4.4.3. An authenticated, unprivileged attacker could exploit this flaw to modify certificate profiles using the certprofile-mod command. This allows the attacker to issue certificates with arbitrary naming or key usage information, which could then be leveraged for further attacks. Rated 6.3 MEDIUM, this vulnerability has a network attack vector and low attack complexity, requiring only low privileges and no user interaction. The potential impact includes low confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.