Vulnerability Details : CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Vulnerability category: BypassGain privilege
Products affected by CVE-2022-2393
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:certificate_system:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:certificate_system:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:pki-core_project:pki-core:*:*:*:*:*:*:*:*
Threat overview for CVE-2022-2393
Top countries where our scanners detected CVE-2022-2393
Top open port discovered on systems with this issue
53
IPs affected by CVE-2022-2393 694,708
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2022-2393!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2022-2393
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-2393
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.7
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.1
|
3.6
|
NIST |
CWE ids for CVE-2022-2393
-
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.Assigned by: secalert@redhat.com (Secondary)
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Secondary)
References for CVE-2022-2393
-
https://bugzilla.redhat.com/show_bug.cgi?id=2101046
2101046 – (CVE-2022-2393) CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by entering name in Subject fieldIssue Tracking;Third Party Advisory
Jump to