CVE-2021-40088

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

• CVE ID
• CVE-2021-40088

• Assigner
• cve@mitre.org

• Vulnerability Status
• Analyzed

• Published Version
• 2021-08-25T02:15:08

• Last Modified Date
• 2021-09-07T14:17:56

• Version
• 2.0

• Vector String
• AV:N/AC:M/Au:S/C:N/I:P/A:P

• Access Vector
• NETWORK

• Access Compatibility
• MEDIUM

• Authentication
• SINGLE

• Confidentiality Impact
• NONE

• Integrity Impact
• PARTIAL

• Availability Impact
• PARTIAL

• Base Score
• 4.9

• Severity
• MEDIUM

• Exploitability Score
• 6.8

• Impact Score
• 4.9

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

• Attack Vector
• NETWORK

• Attack Compatibility
• LOW

• Privileges Required
• LOW

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• NONE

• Availability Impact
• LOW

• Base Score
• 5.4

• Base Severity
• MEDIUM

• Exploitability Score
• 2.8

• Impact Score
• 2.5