PT-2020-12736 · Primekey · Ejbca

Published 2020-04-07 · Updated 2020-04-08 · CVE-2020-11626

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2

Description An issue was discovered in the Public Web and the Certificate/CRL download servlets, where two Cross Side Scripting (XSS) vulnerabilities were found.

Recommendations For EJBCA versions prior to 6.15.2.6, update to version 6.15.2.6 or later. For EJBCA versions 7.x prior to 7.3.1.2, update to version 7.3.1.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-11626

Affected Products

Ejbca

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-11626 · Security Note
• https://support.primekey.com/news/primekey-announcements · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11626 · Vendor Advisory
• https://t.me/cvenotify/2518 · Telegram Post