PT-2021-22798 · Primekey · Primekey Ejbca

Published 2021-08-25 · Updated 2024-03-06 · CVE-2021-40088

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions PrimeKey EJBCA versions prior to 7.6.0

Description An issue was discovered where the CMP RA Mode in PrimeKey EJBCA can be exploited by using a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests. However, while enrollment enforces multi-tenancy constraints by verifying that the client certificate has access to the CA and Profiles being enrolled against, this check was not performed when authenticating revocation operations. This allows a known tenant to revoke a certificate belonging to another tenant.

Recommendations For PrimeKey EJBCA versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-EJBCA-2021-40088

CVE-2021-40088

Affected Products

Primekey Ejbca

References · 4

• https://osv.dev/vulnerability/BIT-ejbca-2021-40088 · Vendor Advisory
• https://support.primekey.com/news/posts/51 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40088 · Security Note