CVE-2021-40087

low-risk
Published 2021-08-25

An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.

Do I need to act?

-
0.10% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.7/10 Low
NETWORK / LOW complexity

Affected Products (1)

Ejbca

Affected Vendors

Primekey

References (2)

Vendor Advisory https://support.primekey.com/news/posts/53
Vendor Advisory https://support.primekey.com/news/posts/53
19
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal