CVE-2021-40087

An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.

CVSS v3 2.7 LOW
CVSS v2.0 4.0 MEDIUM

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.primekey.com/news/posts/53	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*

History

No history.

Information

Published : 2021-08-25 02:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-40087

Mitre link : CVE-2021-40087

CVE.ORG link : CVE-2021-40087

JSON object : View

Products Affected

primekey

ejbca

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2021-40087", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2021-08-25T02:15:08.147", "references": [{"url": "https://support.primekey.com/news/posts/53", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST."}, {"lang": "es", "value": "Se ha detectado un problema en PrimeKey EJBCA versiones anteriores a 7.6.0. Cuando se registraban cambios de auditor\u00eda en las configuraciones de alias de varios protocolos que usan un secreto de inscripci\u00f3n, cualquier modificaci\u00f3n del secreto se registraba en texto sin cifrar en el registro de auditor\u00eda (que s\u00f3lo puede ser visualizado por un administrador). Esto afecta al uso de cualquiera de los siguientes protocolos: SCEP, CMP o EST."}], "lastModified": "2021-09-07T14:12:00.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "69AD9042-C5D5-4D8D-8243-072E5D69E223", "versionEndExcluding": "7.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}