PT-2020-12741 · Primekey · Ejbca

Published 2020-04-07 · Updated 2021-07-21 · CVE-2020-11631

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2

Description An issue allows a malicious user to generate an error state in the CA UI, which can be exploited to lead to privilege escalation and remote code execution. This is only exploitable when at least one accessible port lacks a requirement for client certificate authentication, such as ports 8442 or 8080 in a standard installation.

Recommendations For EJBCA versions prior to 6.15.2.6, update to version 6.15.2.6 or later. For EJBCA versions 7.x prior to 7.3.1.2, update to version 7.3.1.2 or later. As a temporary workaround, consider requiring client certificate authentication for all accessible ports, such as 8442 and 8080, to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-11631

Affected Products

Ejbca

References · 4

• https://support.primekey.com/news/primekey-announcements · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11631 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11631 · Vendor Advisory
• https://t.me/cvenotify/2523 · Telegram Post