CVE-2021-40088: primekey ejbca

csirt@kutim:~/threat-intel/cve/CVE-2021-40088

CVSS 5.4 · Medium EPSS 0,36%

Kerentanan Missing Authorization pada primekey ejbca. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

Rincian

Terbit di NVD: 25 Agustus 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,36% peluang dieksploitasi; lebih tinggi dari 27,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
primekey	ejbca	Semua versi sebelum 7.6.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://support.primekey.com/news/posts/51 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.