PT-2021-22796 · Primekey · Primekey Ejbca

Published 2021-08-25 · Updated 2024-03-06 · CVE-2021-40086

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrimeKey EJBCA versions prior to 7.6.0

Description An issue was discovered where the enrollment secret for SCEP, CMP, EST, and Auto-enrollment aliases is reflected on a page, accessible to administrators. Although the secret is hidden from direct view, it can be revealed by checking the page source.

Recommendations For versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration page for SCEP, CMP, EST, and Auto-enrollment aliases to minimize the risk of the enrollment secret being exposed.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-EJBCA-2021-40086

CVE-2021-40086

Affected Products

Primekey Ejbca

References · 4

• https://support.primekey.com/news/posts/52 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ejbca-2021-40086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40086 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40086 · Vendor Advisory