PT-2020-12738 · Primekey · Ejbca

Published 2020-04-07 · Updated 2020-04-08 · CVE-2020-11628

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2

Description An issue was discovered that allows restrictions on available remote protocols, such as CMP, ACME, and REST, to be bypassed by modifying the URI string from a client. Although EJBCA's internal access control restrictions are still in place, and each respective protocol must be configured to allow for enrollment, the intended system configuration restrictions can be circumvented.

Recommendations For EJBCA versions prior to 6.15.2.6, update to version 6.15.2.6 or later to resolve the issue. For EJBCA versions 7.x prior to 7.3.1.2, update to version 7.3.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected protocols (CMP, ACME, REST, etc.) to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-11628

Affected Products

Ejbca

References · 4

• https://support.primekey.com/news/posts/ejbca-security-advisory-protocol-access-control-bypass · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11628 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11628 · Vendor Advisory
• https://t.me/cvenotify/2520 · Telegram Post