Vulnerability Details : CVE-2008-1676
Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.
Exploit prediction scoring system (EPSS) score for CVE-2008-1676
Probability of exploitation activity in the next 30 days: 0.91%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 81 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-1676
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2008-1676
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-1676
-
https://bugzilla.redhat.com/show_bug.cgi?id=445227
-
http://rhn.redhat.com/errata/RHSA-2008-0500.html
Patch
-
http://www.securitytracker.com/id?1020427
-
http://rhn.redhat.com/errata/RHSA-2008-0577.html
Patch
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/43573
-
http://www.securityfocus.com/bid/30062
Products affected by CVE-2008-1676
- cpe:2.3:a:netscape:certificate_management_system:*:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:certificate_management_system:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:certificate_management_system:6.01:*:*:*:*:*:*:*
- cpe:2.3:a:netscape:certificate_management_system:6.1:*:*:*:*:*:*:*