CVE-2021-40089

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.

CVSS v3 2.3 LOW
CVSS v2.0 1.9 LOW

2.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.primekey.com/news/posts/54	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*

History

No history.

Information

Published : 2021-08-25 02:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-40089

Mitre link : CVE-2021-40089

CVE.ORG link : CVE-2021-40089

JSON object : View

Products Affected

primekey

ejbca

CWE

NVD-CWE-noinfo

{"id": "CVE-2021-40089", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.8}]}, "published": "2021-08-25T02:15:08.280", "references": [{"url": "https://support.primekey.com/news/posts/54", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run."}, {"lang": "es", "value": "Se ha detectado un problema en PrimeKey EJBCA versiones anteriores a 7.6.0. El Editor Personalizado de Prop\u00f3sito General, que normalmente se ejecuta para invocar un script local tras una operaci\u00f3n de publicaci\u00f3n, pod\u00eda seguir ejecut\u00e1ndose si el System Configuration setting Enable External Script Access estaba deshabilitado. Con esta configuraci\u00f3n deshabilitada, no es posible crear nuevos editores de este tipo, pero los editores existentes seguir\u00edan ejecut\u00e1ndose."}], "lastModified": "2021-09-09T19:10:14.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:primekey:ejbca:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "69AD9042-C5D5-4D8D-8243-072E5D69E223", "versionEndExcluding": "7.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}