Vulnerability Details : CVE-2021-40088
An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.
Products affected by CVE-2021-40088
- cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-40088
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-40088
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.9
|
MEDIUM | AV:N/AC:M/Au:S/C:N/I:P/A:P |
6.8
|
4.9
|
NIST | |
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
2.8
|
2.5
|
NIST |
CWE ids for CVE-2021-40088
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-40088
-
https://support.primekey.com/news/posts/51
EJBCA Security Advisory - CMP Revocation Ignores Multi Tenancy Constraints - News / PrimeKey Announcements - PrimeKey SupportVendor Advisory
Jump to