CVE-2019-10195
ipa: Batch API logging user passwords to /var/log/httpd/error_log
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 26, 2019
Updated · February 21, 2026
Description
A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed.
Statement
This vulnerability exists in the server component of FreeIPA. Client packages are not affected.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 5.7CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory